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MARINE  CORPS  UNIT-LEVEL  INTERNAL  MANAGEMENT  CONTROLS 
FOR  THE  GOVERNMENT-WIDE  COMMERCIAL  PURCHASE  CARD 


ABSTRACT 


In  this  thesis,  we  offer  recommendations  to  improve  the 
current  internal  management  controls  for  the  Government -Wide 
Commercial  Purchase  Card  (GCPC)  program.  Despite  the  existence 
of  mandated  internal  management  controls,  the  program  has  been 
fraught  with  fraud,  misuse,  and  abuse  since  its  implementation. 
The  2002  General  Accounting  Office  testimony  on  the  Department 
of  the  Navy  GCPC  program  noted  the  continued  existence  of 
significant  internal  control  weaknesses,  despite  a  number  of 
improvements  made  to  the  program  over  several  years.  Using  the 
fraud  triangle  as  its  philosophical  construct,  this  thesis 
develops  practical  methods  by  which  to  lessen  the  ability  of 
those  involved  with  administration  of  a  GCPC  program  to 
rationalize  improper  and  illegal  actions.  Its  specific 
recommendations  are  to:  convert  the  GCPC  cards  from 
individually  named  credit  cards  to  unit  cards  with  personalized 
numbers;  change  the  appearance  of  the  cards;  control  the  number 
of  cards  within  each  unit  by  authorizing  level  five  agency 
program  coordinators  to  define  and  implement  best  practice 
controls;  and  provide  electronic  receipts  of  all  cardholder 
transactions  daily  to  Approving  Officials  and  Agency  Program 
Coordinators . 
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EXECUTIVE  SUMMARY 


All  federal  agencies,  including  the  Department  of 
Defense  (DoD) ,  use  the  Government-Wide  Commercial  Purchase 
Card  (GCPC)  for  making  "micro-purchases",  which  are  defined 
as  purchases,  from  commercial  vendors,  involving  sums  up  to 
$2500.  Although  purchase  cards  can  be  used  along  with 
other  contracting  methods  to  pay  for  purchases  up  to 
$9,999,900,  their  primary  use  has  been  to  enable 
cardholders  to  buy  low-dollar  value  items  for  the 
government  from  civilian  vendors  while  avoiding  the  longer 
and  more  costly  traditional  acquisition  process.  The 
simplification  of  the  purchasing  process  provided  by  the 
GCPC  program  has  proven  of  tremendous  benefit  to  the  DoD; 
it  has  sped  delivery  of  low-dollar  value  items  while 
lowering  the  direct  costs  associated  with  those  purchases. 
However,  the  program  has  also  experienced  shortcomings, 
particularly  with  regard  to  its  internal  control 
environment . 

As  highlighted  in  the  2002  DoD  Charge  Card  Task  Force 
Final  Report  and  the  2002  General  Accounting  Office 
testimony  on  Navy  purchase  card  vulnerabilities,  weaknesses 
have  existed  throughout  the  DoN  and  Marine  Corps  in  the 
internal  controls  associated  with  the  GCPC  program.  These 
weaknesses  include  lack  of  adherence  to  key  internal 
controls,  and  have  been  coupled  with  high  levels  of  fraud 
and  GCPC  program  card  misuse  and  abuse.  In  recent  years 
the  DoD  and  the  DoN  have  attempted  to  address  many  of  the 
GCPC  program  shortcomings,  principally  by  focusing  efforts 
toward  developing  means  to  identify  fraud  and  to  limit  the 
potential  for  GCPC  program  card  misuse  and  abuse. 
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Despite  the  significant  improvements  made  to  the  GCPC 
program  internal  control  environment  in  the  recent  past, 
one  area  which  holds  potential  to  further  improve  the  GCPC 
program  internal  control  environment  has  not  as  yet 
received  sufficient  attention.  That  area  pertains  the 
rationalization  leg  of  the  fraud  triangle,  an  internal 
management  control  concept  discussed  by  Joseph  T.  Wells  in 
his  book  titled  Occupational  Fraud  and  Abuse.  According  to 
the  fraud  triangle  theory,  one  way  to  help  ensure  an 
adequate  internal  control  environment  is  to  limit  an 
individual's  ability  to  rationalize  his  or  her  potentially 
illicit  activities. 

The  four  recommendations  contained  within  this  report 
were  developed  by  the  authors  as  means  of  combating  the 
rationalization  we  believe  is  inherent  in  the  current  GCPC 
program.  Our  recommendations  are  to:  convert  the  GCPC 
cards  from  individually  named  credit  cards  to  unit  cards 
with  personalized  numbers;  change  the  appearance  of  the 
cards;  control  the  number  of  cards  within  each  unit  by 
authorizing  level  five  APCs  to  define  and  implement  "best 
practice"  controls;  and  provide  electronic  receipts  of  all 
cardholder  transactions  daily  to  approving  officials  and 
agency  program  coordinators.  By  implementing  these  four 
changes,  the  authors  believe  the  DoN  and  Marine  Corps  can 
reduce  the  levels  of  fraud,  misuse,  and  abuse  currently 
experienced  within  the  GCPC  program. 
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I. 


INTRODUCTION 


A.  FRAUD,  ABUSE,  AND  MISUSE  IN  THE  GOVERNMENT-WIDE 
COMMERCIAL  PURCHASE  CARD  PROGRAM 

Military  personnel  did  personal  shopping  at  Wal- 
Mart  and  The  Home  Depot,  partied  at  Hooters  and 
Bottoms  Up  nightclubs  and  charged  personal  items 
like  DVD  players,  computers,  and  pet  supplies  to 
their  government  purchase  cards,  according  to 
documents  obtained  by  The  Associated  Press. ^ 

Documents  gathered  by  Grassley  from  the  Bank  of 
America,  which  handles  Pentagon  travel  credit 
cards,  detail  the  case  of  a  Marine  sergeant  who 
ran  up  $20,000  in  charges,  then  left  the  service 
and  the  bill  unpaid.  The  Marine's  credit  card 
for  travel,  issued  in  March  2000,  was  restricted 
because  he  had  a  questionable  credit  record.  His 
bosses  soon  quadrupled  its  limit  from  $2,500  to 
$10,000,  the  documents  show.  The  bank  issued  a 
fraud  warning  in  August  2000  after  suspicious 
activity  on  the  card,  but  the  Marines  raised  the 
credit  limit  twice  more  to  $25,000.  The  sergeant 
eventually  made  two  cash  withdrawals  from  the 
card  over  two  months  totaling  $8,500.  The 
Marine's  credit  was  finally  revoked  in  February, 
almost  a  year  after  it  was  issued,  and  he  left 
the  service.  The  bank  was  forced  to  write  off 
the  debt  as  a  loss.^ 

The  General  Accounting  Office  (GAO)  has  uncovered 
what  may  be  the  tip  of  the  iceberg  with  regard  to 
improper  purchases  by  people  empowered  to  buy 
using  their  government -wide  purchase  cards  at  two 
Navy  units  in  San  Diego.  GAO  found  "With  the 
ineffective  overall  internal  control  environment, 
it  is  not  surprising  that  the  three  basic 
internal  controls  ...  were  ineffective." 


1 .  http : //www . detnews . com/2001/politics/ 0107/2 9/politics-25647 9 . htm.  Author : 
John  Solomon,  Associated  Press,  Pentagon  Employees  Rang  Up  $9  Billion  on 
Government  Credit  Cards^  28  Jul  2001 

2.  FreeRepublic.com,  Author:  AP,  "A  Conservative  News  Forum",  7/27/2001 
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They  also  recounted  five  cases  of  alleged 
purchase  card  fraud  of  which  one  case  has  been 
successfully  prosecuted.  The  amount  involved  in 
all  five  was  over  $660,000  to  date  with 
investigations  continuing  in  the  remaining  four 
cases.  Here's  what  was  bought  for  personal  use: 
home  improvement  items,  laptops,  electronic 
organizers,  DVD  players,  an  air  conditioner, 
clothing,  jewelry,  and  other  items  such  as 
eyeglasses,  pet  supplies,  phone  calls,  tires, 
flowers,  and  pizza.  GAO  says,  "The  control 
breakdowns  related  to  the  frauds  were  so 
pervasive  that  the  total  dollar  amount  of  these 
frauds  could  not  be  determined." 

One  unit  bought  flat  panel  computer  monitors 
costing  from  $800  to  $2,500  each  instead  of 
standard  monitors  costing  $300.  When  asked  about 
this  at  a  congressional  hearing,  the  Navy 
suggested  that  they  were  required  to  conserve 
space  onboard  ships.  However,  not  all  were  used 
onboard  ships.  Also  uncovered  were  routine 
purchases  without  documented  government  need, 
including  electronic  organizers  as  well  as  the 
accompanying  $100  designer  carrying  cases  and  a 
$400  leather  briefcase.  Neither  Navy  unit  had 
documented  policies  and  procedures  to  support  the 
valid  need  for  these  types  of  items.  There  also 
were  cases  where  a  cardholder' s  single  day 
purchases  from  the  same  vendor  appeared  to  be  a 
circumvention  of  the  cardholder' s  single  purchase 
limit . ^ 


As  highlighted  in  the  preceding  articles,  it  has 
proven  difficult  for  the  Department  of  Defense  (DoD) , 
Department  of  the  Navy  (DoN) ,  and  U.S.  Marine  Corps  to 
maintain  adequate  internal  control  environments  for  the 
Government-Wide  Commercial  Purchase  Card  (GCPC)  and 
Official  Travel  Card  programs.  This  difficulty  has  been 


3.  http://www.managementconcepts.com/acquisition/NavyCardarchive.asp,  24  Oct  03 
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manifested  in  numerous  instances  of  purchase  card  program 
fraud,  and  card  abuse  and  misuse.  And  yet  having  a  robust 
internal  control  environment  is  a  key  factor  in  preventing 
the  types  of  illicit  card  use  which  have  all  too  often 
characterized  the  program.  In  seeking  ways  to  improve 
existing  internal  controls  for  the  purchase  card  program, 
one  would  naturally  review  current  management  ideas  dealing 
with  internal  controls  for  organizations.  One  current  such 
management  idea  was  discussed  by  Joseph  T.  Wells,  founder 
of  the  Association  of  Certified  Fraud  Examiners,  in  his 
book  Occupational  Fraud  and  Abuse.  Wells  argues  that  for 
fraud  to  occur  there  must  exist  three  legs  of  support  for  a 
fraud  triangle,  those  legs  consisting  of  incentive, 
opportunity,  and  rationalization. 

Accordingly,  one  way  to  help  ensure  an  adequate 
internal  control  environment  is  to  limit  an  individual's 
ability  to  rationalize  his  or  her  potentially  illicit 
activities;  by  lessening  the  ability  of  an  individual  to 
convince  himself  that  his  activities  are  justifiable  (due 
to  perceived  urgency  of  need,  that  he  deserves  or  requires 
an  item  despite  existing  guidance  or  instructions  to  the 
contrary,  that  an  action  can  be  construed  as  within  the 
larger  meaning  of  those  instructions,  etc.),  an 
organization  should  be  able  to  lower  the  probability  that 
members  of  that  organization  will  commit  fraud  against  it. 
Along  with  measures  designed  to  limit  the  ability  of 
individuals  to  rationalize  wrongful  behavior,  internal 
controls  can  also  be  designed  to  limit  the  opportunities, 
and  where  possible  the  incentives,  to  commit  fraud. 

Undoubtedly,  because  the  GCPC  program  provides 
individuals  the  ability  to  access  and  use  large  amounts  of 
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government  credit,  the  program  will  always  be  vulnerable  to 
the  risk  of  fraud.  An  incentive  to  steal  is  inherent  in 
the  program,  and  a  thief  determined  to  steal  by  use  of  his 
GCPC  card  obviously  will  have  the  opportunity  to  do  so. 
However,  automated  measures  (such  as  restrictions,  or 
blocks,  on  where  purchases  can  be  made) ,  verification 
requirements,  and  audit  procedures  can  largely  suffice  to 
identify  illicit  card  use  and  monetarily  limit  an 
individual's  ability  to  defraud  the  government. 

On  the  other  hand,  an  individual  who  intentionally 
steals  makes  no  attempt  to  rationalize  his  activities.  As 
can  be  ascertained  from  the  Marine  Corps'  Purchase  Card 
Semi-Annual  Review  for  the  first  half  of  fiscal  year  2003 
(Appendix  A) ,  many  of  those  making  illicit  purchases  with 
their  CCPC  cards  or  ignoring  existing,  mandatory  internal 
controls  and  established  internal  control  processes,  would 
not  consider  themselves  thieves.  At  the  time  of  their 
illicit  purchases,  they  most  likely  rationalized  those 
purchases  as  not  being  the  illegal  activities  they  in  fact 
were  . 

Whether  purchasing  a  sandwich  at  Subway  or  bedding  and 
towels  for  a  visiting  foreign  military  officer,  otherwise 
trusted  and  diligent  government  employees  improperly  used 
their  government  purchase  cards;  yet  because  many  of  those 
purchases  involved  very  low  dollar  amounts  or  did  not 
directly  benefit  the  purchaser,  it  is  likely  they  saw  those 
purchases  as  not  truly  representing  fraud  against  the 
government  of  the  United  States.  Additionally,  the 
cardholder' s  unit  may  tend  to  see  any  illicit  use  as 
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reflecting  only  on  the  individual  cardholder  and  not  on  the 
unit  itself  as  the  card  are  issued  in  the  cardholder's,  and 
not  the  unit's,  name. 

This  ability  to  rationalize  card  fraud,  misuse,  and 
abuse  contributes  to  the  poor  internal  control  environment 
perceived  to  exist  throughout  the  GCPC  program  and  detailed 
in  both  the  2002  DoD  Charge  Card  Task  Force  Final  Report 
and  General  Accounting  Office  (GAO)  Testimony  regarding 
Navy  vulnerabilities  to  fraud.  While  one  could  debate  the 
legitimacy  of  the  rationalizations  a  GCPC  program 
cardholder  might  make,  and  while  the  ability  to  rationalize 
a  wrongful  action  does  not  make  it  justifiable,  the  current 
purchase  card  internal  control  environment  can  be  improved 
by  implementing  internal  control  measures  designed  to  help 
eliminate  the  ability  of  individuals  to  rationalize  the 
improper  use  of  GCPC  program  cards.  In  this  report  we  will 
attempt  to  develop  practical  means  by  which  to  lessen  the 
ability  of  those  involved  with  administration  of  a  GCPC 
program  to  rationalize  improper  and  illegal  actions.  First 
however,  we  will  outline  the  current  structure  and 
functioning  of  the  GCPC  program  and  further  expand  upon  the 
underlying  management  theory  that  guided  the  development  of 
this  report . 

B.  OVERVIEW  OF  THE  GOVERNMENT-WIDE  COMMERCIAL  PURCHASE 

CARD  PROGRAM 

The  GCPC  program  has  its  roots  in  the  1982 
Presidential  Executive  Order  12352,  "Procurement  Reform", 
which  directed  the  DoD,  as  well  as  all  executive  agencies, 
to,  "Establish  programs  to  simplify  small  purchases"  along 
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with  other  initiatives  intended  to  streamline  and  simplify 
various  governmental  procurement  processes.^  On  July  6, 
1998,  the  DoN  awarded  a  three-year  contract,  with  options 
for  extending  the  service  period,  to  Citibank  to  provide 
purchase  card  services  throughout  the  DoN.^  Currently 
managed  by  the  DoN  eBusiness  Operations  Office 
(EBUSOPSOFF) ,  the  program  is  part  of  the  U.S.  General 
Services  Administration' s  (GSA)  "SmartPay"  program,  whose 
current  contracts  with  five  service  providers  (Bank  of 
America,  Bank  One,  Citibank,  Mellon  Bank,  and  U.S.  Bank) 
are  effective  until  November  29,  2003.® 

For  the  Marine  Corps,  the  Contracts  Division, 
Installations  and  Logistics  Department,  Headquarters,  U.S. 
Marine  Corps  (LB,  I&L,  HQMC)  has  oversight  responsibility 
for  the  GCPC  program  and  maintains  a  GCPC  program  office 
within  the  Management  and  Oversight  Branch  (LBM)  of  the  LB 
Division . 

According  to  the  executive  summary  of  the  June  27, 

2002  DoD  Charge  Card  Task  Force  Final  Report, 
implementation  of  the  GCPC  program  had  resulted  in  an 
estimated  savings  of  $900  million  by  the  report  date.  GCPC 
program-generated  savings  result  from  rebates  based  on 
volume  of  transactions  and  cost  reductions  resulting  from 
the  automation  of  purchase  order  processes. 


4.  Executive  Order  12352,  17  Mar  1982. 

5.  http://www.don-ebusiness.navsup.navy.mil,  30  Oct  2003. 

6 .  http : / /www . gsa . gov/Portal/gsa/ep/channelView . do?pageTypeId=81 99&channelPage= 
%2Fep%2Fchannel%2FgsaOverview. jsp&channelld=-13497,  31  Oct  2003. 


The  purpose  of  the  GCPC  program,  as  stated  in  the 
EBUSOPSOFF  Instruction  (EBUSOPSOFFINST)  4200. lA,  is: 

to  provide  DoN  civilian  and  military  employees  a 
convenient  and  commercially  available  method  to 
make  low-dollar  value  purchases.'^ 

Low-dollar  purchases,  also  called  "micro-purchases",  are 
defined  as  those  less  than  $2500.  Purchase  cards  are  used 
throughout  the  DoD  and  can  be  used  along  with  other 
contracting  methods  to  pay  for  purchases  up  to  $9,999,900. 

In  essence,  GCPC  cards  are  commercial  credit  cards. 

The  cards  enable  cardholders  to  buy  low-dollar  value  items 
for  the  government  from  civilian  vendors  while  avoiding  the 
longer  and  more  costly  traditional  acquisition  process. 

This  simplification  of  the  purchasing  process  has  proven  of 
tremendous  benefit  to  the  DoD;  it  has  sped  delivery  of  low- 
dollar  value  items  while  lowering  the  direct  costs 
associated  with  those  purchases.  However,  the  program  has 
also  experienced  shortcomings,  particularly  with  regard  to 
its  internal  control  environment. 

As  highlighted  in  the  2002  GAO  testimony  on  Navy 
purchase  card  vulnerabilities,  weaknesses  have  existed 
throughout  the  DoN  in  the  internal  controls  associated  with 
the  GCPC  program.  These  weaknesses,  which  include  lack  of 
adherence  to  key  internal  controls  and  shortcomings  in  the 
program' s  management  culture  and  existing  supporting 
infrastructure,  have  resulted  in  fraud  and  card  misuse  and 


7.  EBUSOPSOFFINST  4200. lA,  p.  III. 
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abuse  by  GCPC  cardholders.^  These  types  of  weaknesses, 
common  to  GCPC  programs  throughout  the  DoD  and  the  entire 
U.S.  Government,  have  drawn  increasing  managerial  attention 
within  DoD  since  implementation  of  the  GCPC  program.  Past 
attempts  to  improve  the  GCPC  program  internal  control 
environment  have  included  measures  designed  to  identify 
fraud  as  well  as  to  limit  the  potential  for  card  misuse  and 
abuse.  The  DoN  and  Marine  Corps  have  addressed  many  of  the 
weaknesses  articulated  in  the  2002  GAO  testimony  and  DoD 
Charge  Card  Task  Force  Final  Report,  and  we  will  briefly 
outline  the  recommendations  made  in  those  reports  and  the 
corrective  actions  already  taken  in  response  to  those 
recommendations . 

But,  despite  the  significant  improvements  made  to  the 
GCPC  program  internal  control  environment  in  the  recent 
past,  our  research  into  the  GCPC  program  and  those  past 
improvements  has  led  us  to  believe  that  one  area  which 
holds  potential  to  further  improve  the  GCPC  program 
internal  control  environment  has  not  as  yet  received 
sufficient  attention.  That  area  pertains  to  the  concept  of 
the  rationalization  leg  of  the  fraud  triangle,  which  we 
will  discuss  in  this  report.  We  believe  that  by 
implementing  measures  designed  to  reduce  the  potential  for 
rationalization  of  illicit  purchases  by  cardholders,  the 
Marine  Corps,  DoN,  and  DoD  could  further  improve  the 
current  GCPC  program  internal  control  environment.  As 
such,  we  offer  four  specific  recommendations  to  improve  the 
GCPC  program  internal  control  environment  for  Marine  Corps 


8.  GAO  Testimony  Before  the  Subcommittee  on  Government  Efficiency,  Financial 
Management  and  Intergovernmental  Relations,  Committee  on  Government  Reform,  House 
of  Representatives,  p.  2. 
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units  which  administer  GCPC  programs:  conversion  of  the 
GCPC  program  from  individually  named  issued  credit  cards  to 
unit  cards  with  personalized  card  numbers;  changing  the 
physical  appearance  of  the  GCPC  program  cards;  authorizing 
level  five  APCs  to  determine  unit  best  practice;  and 
providing  electronic  receipts  of  all  cardholder 
transactions  to  Approving  Officials  (AOs)  and  Agency 
Program  Coordinators  (APCs) . 

C.  SCOPE  OF  RESEARCH 

This  report  is  focused  on  the  internal  management 
controls  associated  with  GCPC  programs  in  Marine  Corps 
operating  forces  units.  Although  recommendations  contained 
within  this  report  may  be  applicable  to  other  managerial 
levels  of  the  GCPC  program,  we  sought  specifically  to 
examine  existing  internal  management  controls  in  use  by 
Marine  Corps  operating  forces  units  and  to  offer 
recommendations  for  improving  those  controls.  Currently, 
each  unit  managing  a  GCPC  program  must  meet  specified 
controls  (which  we  will  outline  in  this  report)  and  is 
encouraged  to  implement  other  local  controls  as  deemed 
necessary  by  the  unit. 

The  topic  of  examining  the  internal  controls  for  the 
GCPC  program  was  originally  suggested  by  an  action  officer 
from  LB,  I&L,  HQMC  as  an  area  which  held  potential  for  a 
Naval  Postgraduate  School  Master  of  Business  Administration 
Project.  Our  research  began  with  a  review  of  the  2002  GAO 
Testimony  regarding  Navy  vulnerabilities  to  fraud  and  GCPC 
program  card  abuse  and  the  2002  DoD  Charge  Card  Task  Force 
Final  Report,  extended  to  review  of  existing  DoD  and  DoN 
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testimonies  regarding  the  internal  controls  and  existing 
weaknesses  found  throughout  many  levels  of  the  GCPC  program 
within  the  DoD  and  DoN,  and  included  reviews  of  current  DoN 
orders  and  regulations  for  management  of  a  GCPC  program. 

We  also  reviewed  the  on-line  training  programs  sponsored  by 
the  DoN  e-Business  Operations  Office  and  the  Defense 
Acquisition  University  Continuous  Learning  Center.  We 
conducted  interviews  with  the  Marine  Corps  Base  Camp 
Pendleton  and  Marine  Corps  Air  Station  Miramar  APCs  as  to 
the  strengths  and  weaknesses  they  saw  within  their  programs 
and  conducted  phone  interviews  or  sought  information  from  a 
variety  of  other  individuals  involved  in  management  of  the 
GCPC  program  in  the  Marine  Corps  and  within  the  DoN. 

Following  our  initial  review  of  documents,  we  narrowed 
the  scope  of  our  research  to  focus  strictly  on  the  internal 
control  environment  associated  with  management  of  a  GCPC 
program  at  the  Marine  Corps  unit  (battalion/squadron) 
level.  By  doing  so,  we  limited  our  detailed  evaluation  to 
those  controls  mandated  or  recommended  for  use  by  unit 
cardholders,  approving  officials,  and  agency  program 
coordinators.  We  found  that  many  potential  improvements 
applicable  to  all  levels  of  the  DoD  GCPC  program  had 
already  been  identified  or  implemented.  The  types  of 
improvements  made  to  the  GCPC  program  in  the  last  several 
years  include  automation  of  the  billing  statement 
reconciliation  process  (and  thus  a  speeding  up  of  the 
payment  process  to  card  issuers) ,  limitation  of  the  number 
of  cardholders  managed  by  AOs  and  APCs,  improvement  to  GCPC 
program  training,  and  development  of  data-mining 
capabilities.  Rather  than  attempting  to  evaluate  those 
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initiatives,  we  sought  to  identify  new  areas  in  which  the 
internal  controls  for  a  unit-level  GCPC  program  could  be 
strengthened . 

As  a  result  of  our  research,  we  have  identified  what 
we  believe  to  be  an  area  in  which  the  GCPC  program  internal 
control  environment  can  be  further  improved.  By 
implementing  measures  designed  to  help  break  the 
rationalization  leg  of  the  fraud  triangle,  we  believe  the 
occurrence  of  fraud,  misuse,  and  abuse  of  GCPC  cards  can  be 
further  reduced.  This  report  will  detail  our 
recommendations  for  accomplishing  that  reduction. 

D.  THE  FRAUD  TRIANGLE 

As  depicted  below,  the  fraud  triangle  consists  of 
three  legs,  each  of  which,  according  to  the  theory,  need  to 
exist  to  some  extent  for  fraud  to  occur  within  an 
organization . 


The  Fraud  Triangle 


Three  condrtMns  are  pretant  when  fraud  eccun. 


Figure  1.  The  Fraud  Triangle.  (From: 

http : / / WWW . aiepa . org/pubs/ jofa/ jan2003/ ramos . htm) 
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The  Society  for  Human  Resource  Management  describes  the 
fraud  triangle  as  follows: 

To  reduce  embezzlement  losses,  experts  say 
employers  must  start  by  examining  the  three 
factors  that  lead  employees  to  pocket 
corporate  dollars.  Those  factors  form  "the 
fraud  triangle,"  which  is  expressed  by  the 
following  equation:  motivation  +  opportunity 
+  rationalization  =  embezzlement . 

Motivation  refers  to  financial  pressure  on 
employees— such  as  medical  bills,  college 
tuition  payments,  gambling  debts,  lifestyle 
changes,  etc.  —  with  additional  stress  if 
the  employee  feels  he  can't  share  his 
predicament  with  others. 

Opportunity  means  an  employee  is  in  a 
position  to  embezzle.  That  can  translate  to 
access  to  cash,  goods  or  other  company 
assets  —  and  controls  that  are  inadequate  or 
non-existent . 

Rationalization  is  the  personal 
justification  employees  use  to  convince 
themselves  to  commit  embezzlement.  "It's 
just  a  loan,"  they  might  tell  themselves. 

Other  rationalizations  include:  I'm 
underpaid  compared  to  others;  I'm  entitled, 
the  boss  is  getting  paid  too  much;  others 
are  doing  it,  etc. 

The  good  news  is  that  employers  can  slash 
the  potential  for  embezzlement  if  they 
eliminate  or  reduce  any  one  of  the  three 
elements . ^ 

As  we  will  discuss  in  this  report,  we  believe  past 
efforts  to  improve  the  GCPC  program  internal  control 


9.  Society  for  Human  Resource  Management  October  2003,  Vol.  48,  No.  10,  The  Five- 
Finger  Bonus  by  Robert  J.  Grossman.  Used  with  permission  of  HR  Magazine, 
published  by  the  Society  for  Human  Resource  Management,  Alexandria,  Va.  All  rights 
reserved. 
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environment  have  mainly  targeted  the  opportunity  leg  of  the 
fraud  triangle,  with  the  goals  of  lessening  the  opportunity 
for  individuals  to  commit  fraud  and  to  quickly  identify 
fraud,  as  well  as  card  misuse  and  abuse,  when  it  occurs. 

Our  recommendations  will  be  targeted  instead  toward 
reducing  the  rationalization  leg  of  the  fraud  triangle;  by 
successfully  doing  so  we  believe  units  administering  GCPC 
programs  can  improve  their  existing  GCPC  internal  control 
environments.  Before  detailing  our  recommendations,  we 
will  outline  the  functioning  of  a  purchase  card  program  and 
discuss  pertinent  elements  of  the  2002  GAO  testimony  and 
Charge  Card  Task  Force  report  referenced  earlier. 
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II.  THE  GOVERNMENT-WIDE  COMMERCIAL  PURCHASE  CARD 

PROGRAM  STRUCTURE 


A.  GCPC  PROGRAM  STRUCTURE 

Several  layers  of  responsibility  are  involved  in  the 
administration  of  a  DoN  GCPC  program;  the  program  follows 
the  hierarchical  structural  design  depicted  in  the 
following  diagram: 


CHAPTER  2:  MANAGING  COMMAND 

PURCHASE  CARD  PROGRAMS 

Purchase  Card  Hierarchy  Diagram. 
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Figure  2.  Purchase  Card  Hierarchy  Diagram.  (From:  DoN 
EBUSOPSOFFINST  4200. lA,  p.  13) 
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While  not  exhaustive  in  specifying  all  aspects  of  the 
administration  of  a  local  GCPC  program,  we  will  sketch  how 
the  program  is  intended  to  function  and  describe  the  duties 
of  those  involved  in  a  local  program  in  the  next  few 
paragraphs.  We  then  describe  the  internal  controls  for  a 
GCPC  program  as  specified  in  EBUSOPSOFFINST  4200. lA. 

B.  GCPC  PROGRAM  ADMINISTRATION 

At  the  lowest  level  of  the  GCPC  program  is  the  actual 
GCPC  cardholder.  Next  is  the  Approving  Official  (AO), 
responsible  for  approving  the  cardholder' s  purchases  and 
certifying  monthly  invoices  from  Citibank.  The  unit-level 
(level  five)  Agency  Program  Coordinator  (APC)  supervises 
the  entire  unit's  GCPC  program  for  the  Head  of  Activity 
(HA),  normally  the  unit's  Commanding  Officer.  Above  the  HA 
are  various  APC  levels,  individuals  responsible  for 
coordinating  an  ever-broadening  scope  of  the  GCPC  program, 
up  to  the  Major  Claimancy  level. 

Per  EBUSOPSOFFINST  4200. lA,  all  DoN  GCPC  program 
cardholders,  AOs,  and  APCs  are  required  to  complete  GCPC 
program  training  before  beginning  to  participate  in  the 
program.  The  training  can  be  conducted  over  the  internet 
and  consists  of  a  minimum  of  two  different  parts.  Training 
tailored  to  individual  roles  within  a  GCPC  program  is 
offered  on  the  Navy's  e-Business  website;  additionally, 
participants  must  take  the  GCPC  program  tutorial  offered 
through  the  Defense  Acquisition  University  Continuous 
Learning  Center. Once  training  is  completed,  GCPC  program 

10.  EBUSOPSOFFINST  4200. lA,  p.  26 
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participants  are  required  to  adhere  to  the  program 
administration  rules  outlined  in  the  EBUSOPSOFFINST 
4200 . lA. 

The  training  available  from  the  DoN  eBusiness 
Operations  Office  is  available  at  www.don- 

ebusiness.navsup.navy.mil  and  is  depicted  in  the  web-page 
snapshot  below: 


Figure  3.  Purchase  Card  Training.  (From:  http/ /www . don- 
ebusiness  . navsup . navy . mi 1 ) 

By  clicking  a  computer  mouse  on  the  different  portions 
of  this  website,  an  individual  is  automatically  linked  to 
training  tailored  to  his  specific  duties  within  the  GCPC 
program,  as  well  as  being  afforded  on-line  access  to  other 
documents  and  information,  such  as  EBUSOPSOFFINST  4200.  lA 
and  various  desk  guides.  After  successfully  completing  the 
initial  training,  individuals  are  required  to  complete 
refresher  training  at  least  once  every  two  years,  as  well 
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as  completing  annual  ethics  training  (as  found  in  Joint 
Ethics  Regulations  DoD  5500  7-R  and  5  CFR  2638.705) 

Although  in  practice  the  administrative  structure  of  a 
GCPC  program  may  vary  slightly  from  unit  to  unit  based  on 
differing  capabilities  and  requirements  (for  instance,  due 
to  personnel  restrictions,  an  AO  could  also  serve  as  a 
cardholder  within  a  unit) ,  the  basic  structure  is  the 
straightforward  hierarchy  depicted  in  Figure  2.  Following 
successful  completion  of  training  and  designation  by  the 
HA,  an  individual  is  assigned  duties  as  a  cardholder,  AO, 
or  ARC,  and  Citibank  is  notified  (by  the  unit's  ARC,  or 
next  higher  level  APC)  of  the  assignment.  AOs  can 
supervise  up  to  seven  subordinate  cardholder  accounts  and 
are  responsible  for  overseeing  and  auditing  those  accounts. 
A  level  five  (i.e.,  unit)  APC  can  be  assigned  to  oversee  up 
to  three  hundred  individual  cardholder  accounts.  Once  a 
cardholder  has  been  officially  assigned  as  such  by  his  HA, 
the  APC  sets  up  the  CCPC  program  cardholder' s  account  with 
Citibank,  normally  on-line,  and  the  cardholder  then 
receives  a  CCPC  program  card  from  Citibank.  The  unit  APC 
also  ensures  cardholders  attend  required  refresher 
training,  facilitates  the  issuance  of  the  card  to  the 
cardholder,  and  sets  the  cardholder' s  single  purchase  and 
monthly  transaction  limits,  as  designated  by  the  HA. 

The  CCPC  is  issued  individually  to  the  cardholder  and, 
although  stating  that  the  card  is  to  be  used  only  for 
official  U.S.  Covernment  purchases,  bears  the  cardholder's 
name.  The  cardholder  is  responsible  for  making  only 
approved  purchases  with  the  card  and  bears  pecuniary 

11.  EUSOPSOFFINST  4200. lA,  p.  26 
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liability  to  the  U.S.  Government  for  illegal  purchases. 

The  cardholder  is  also  responsible  to  review  mandatory 
sources  of  supply  (the  Javit s-Wagner-O' Day  Act  Program 
(JWOD) ,  Federal  Prison  Industries  (FPI),  and  per  the 
Resource  Conservation  and  Recovery  Act) ,  reconcile  monthly 
billing  statements  from  Citibank,  act  to  resolve  any 
discrepancies  in  those  statements,  and  certify  monthly 
invoices  for  payment. 

AOs  approve  cardholder  purchases,  verify  the  monthly 
statements  for  each  of  their  cardholders,  and  forward  their 
certifications  of  those  statements  to  Defense  Finance  and 
Accounting  Service  (DFAS) .  Upon  AO  certification  of  a 
cardholder's  monthly  statement,  DFAS  pays  Citibank  for  the 
validated  transactions. 

Level  five  APCs,  in  addition  to  overseeing  the 
training  of  cardholders  and  AOs  and  the  issuance  of  GCPC 
cards  within  their  units,  coordinate  with  higher-level 
APCs,  monitor  the  activities  of  their  AOs  and  cardholders, 
and  coordinate  with  Citibank  when  necessary  to  help  resolve 
discrepancies.  Level  five  APCs  also  conduct  monthly 
transactional  reviews  of  the  transactions  of  all  their 
subordinate  cardholders,  attempting  to  identify  any 
questionable  card  activity  for  additional  investigation  (p. 
29),  and  ensure  the  accuracy  of  their  account  profiles  at 
least  quarterly  (by  checking  to  ensure  the  AO/cardholder 
span  of  control  remains  within  boundaries  and  that  those 
individuals  listed  by  Citibank  as  active  members  of  the 
local  program  are  in  fact  still  participants  in  the 
program . 

12.  EBUSOPSOFFINST  4200. lA,  p.  27. 
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Additionally,  level  five  APCs  are  responsible  to 
conduct  semi-annual  reviews  of  the  functioning  of  their 
local  programs. 

Lastly,  EBUSOPSOFFINST  4200. lA  specifies  that  a  unit 
Review  Official  (RO)  audit  AO  certifications  using 
stratified  statistical  random  sampling  methods.  The  RO, 
although  a  member  of  the  unit,  should  not  be  within  the 
AO' s  supervisory  chain-of -command  and  is  meant  to  provide 
an  additional  means  to  help  ensure  the  validity  and 
timeliness  of  GCPC  program  payments  (pp  4  &  15-16) 

Although  as  described  in  the  EBUSOPSOFFINST  4200. lA,  a 
GCPC  unit  program  appears  uncomplicated,  in  practice  one 
may  prove  difficult  to  manage  due  to  personnel  rotations, 
lack  of  program  familiarization  among  participants,  or 
other  factors.  Likewise,  the  internal  controls  specified 
in  the  Instruction  and  the  training  materials  which  serve 
the  program  appear  simple  and  logical,  and  in  many  cases 
intuitive.  It  is  to  a  description  of  the  internal  controls 
specified  in  the  EBUSOPSOFFINST  4200. lA  which  we  next  turn. 

C.  GCPC  PROGRAM  INTERNAL  CONTROLS 

In  addition  to  outlining  the  individual 
responsibilities  of  those  involved  in  a  GCPC  program, 
EBUSOPSOFFINST  4200. lA  specifies  the  internal  controls  to 
be  used  to  help  prevent  GCPC  program  card  fraud,  misuse, 
and  abuse.  These  controls  include:  separation  of  duties; 
separation  of  functions;  limitation  of  spans  of  control; 
completion  of  required  training;  establishment  of  single 

13.  EBUSOPSOFFINST  4200. lA,  p.  28. 

14.  EBUSOPSOFFINST  4200. lA,  p .  4  &  15-16. 
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purchase  and  billing  cycle  (30  days)  limits;  limitation  of 
authorized  transaction  types;  utilization  of  merchant 
category  code  blocks;  closure  of  unneeded  accounts;  and 
conduct  of  internal  program  reviews.  The  Instruction  also 
encourages  units  to  develop  their  own  internal  operating 
procedures  for  management  of  their  individual,  local  GCPC 
programs . 

According  to  the  Instruction,  cardholders,  AOs,  and 
APCs  should  be  different  individuals;  when  such  separation 
is  not  possible,  the  Instruction  outlines  procedures  to 
ensure  that  more  than  one  individual  is  involved  in  the 
purchasing,  receipting,  and  accounting  for  items  procured 
by  use  of  a  GCPC  program  card.  In  addition  to  this 
separation  of  duties,  the  Instruction  also  requires  a 
separation  of  functions,  specifying  that  someone  other  than 
the  cardholder  receipt  for  purchased  items,  or  at  least 
verifies  receipt  of  purchased  items  if  the  cardholder  is 
also  the  end  user  of  the  items  being  purchased.  These 
procedures  to  separate  program  administration  duties  and 
purchase  and  receipt  functions  are  intended  to  ensure  that 
no  one  individual  can  solely  conduct,  receipt  for,  approve, 
certify,  and  account  for  GCPC  purchases.  Ensuring  that 
multiple  individuals  are  involved  in  the  purchase  and 
receipt  of  items  and  the  certification  of  those 
transactions  for  payment  is  a  fundamental  control  measure 
designed  to  limit  the  potential  for  perpetration  of  fraud 
within  an  organization. 

EBUSOPSOFFINST  4200. lA  limits  spans  of  control  within 
a  GCPC  program.  AOs  are  limited  to  supervising  no  more 
than  seven  cardholders,  while  level  five  APCs  are  limited 
to  overseeing  a  total  of  three  hundred  cardholders.  These 
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spans  of  control  are  meant  to  ensure  both  AOs  and  APCs  can 
reasonably  conduct  their  review  and  audit  responsibilities 
as  outlined  in  the  Instruction. 

As  described  previously,  unit  APCs  act  to  ensure  all 
GCPC  program  personnel  complete  at  least  the  required 
initial  training  prior  to  participation  in  the  program; 
they  are  also  responsible  to  ensure  participants  complete 
refresher  training  at  least  once  every  two  years  and  annual 
ethics  training.  Additionally,  APCs  establish  cardholder 
single  purchase  and  billing  cycle  monetary  limits  as 
specified  by  the  AH  who  appointed  the  cardholder.  These 
limits  are  supposed  to  be  based  on  an  analysis  of  unit 
historic  spending  patterns  and  should  reflect  actual  unit 
spending  requirements. 

While  the  enforcement  of  training  requirements 
certainly  helps  ensure  individuals  remain  cognizant  of  the 
proper  boundaries  of  the  use  of  their  GCPC  program  cards, 
limitations  to  spending  authorizations  are  intended  to 
lessen  the  monetary  impact  of  any  fraud  or  other  illicit 
spending.  As  a  cardholder  can  not  exceed  his  single 
purchase  or  monthly  limits  without  his  APC  increasing  those 
purchase  card  authorization  limits,  any  attempt  to 
illicitly  spend  the  government's  money  at  a  level  higher 
than  that  normally  expended  by  a  unit  in  a  day  or  during  a 
month  would  require  the  collusion  of  the  APC  in  the 
attempted  fraudulent  use  of  the  card. 

A  cardholder' s  account  can  be  limited  to  certain 
transaction  types  (no  internet  orders,  for  instance) ,  and 
all  cards  within  the  DoD  are  blocked  from  use  at  businesses 
registered  under  certain  merchant  category  codes  (see 
Appendix  B  for  a  full  listing  of  DoD-wide  blocked  codes) . 


These  blocks  prevent  all  purchases  at  merchants  categorized 
by  those  codes.  Other  merchant  category  codes  can  be 
blocked  if  not  needed  by  the  individual  cardholder  for  the 
types  of  transactions  he  is  authorized  to  conduct. 

Limiting  transaction  types  and  blocking  merchant  codes  are 
measures  designed  to  prevent  approval  of  transactions  at 
the  point  of  sale  at  businesses  for  which  there  is  no 
identified  requirement  for  the  cardholder  to  make 
purchases.  Furthermore,  enclosure  (2)  of  EBUSOSOFFINST 
4200. lA  lists  additional  prohibitions  pertaining  to  use  of 
the  GCPC,  as  well  specifying  the  rules  governing  exceptions 
to  those  prohibitions.  These  internal  controls  are,  of 
course,  intended  to  help  prevent  cardholders  from  knowingly 
or  inadvertently  using  their  GCPC  cards  to  conduct 
proscribed  transactions. 

According  to  EBUSOPSOFFINST  4200. lA,  APCs  are  to 
suspend  cardholder  accounts  thirty  days  before  a  cardholder 
transfers  from  the  command  and  to  close  inactive  or  no 
longer  needed  accounts. The  thirty-day  suspension  is 
intended  to  ensure  a  cardholder  does  not  transfer  from  his 
command  before  certification  of  his  last  monthly  bill.  AOs 
must  review  every  cardholder  transaction  monthly  before 
certifying  their  cardholder's  statements,  and  ROs  are 
required  to  audit  the  monthly  AO  certifications  for  all  the 
unit's  cardholders.  Although  level  five  APCs  do  not  have 
to  certify  each  individual  cardholder  transaction  (which 
can  easily  number  in  the  thousands) ,  they  do  have  to  screen 
all  those  transactions  and  attempt  to  identify  fraudulent 
activity  in  the  accounts.  APCs  are  specifically  directed 

15.  EBUSOPSOFFINST  4200. lA,  p.  27 
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to  attempt  to  identify  suspicious  vendors,  split  purchases, 
inequitable  distribution  of  business,  and  any  other 
suspected  card  misuse  or  fraud.  APCs  also  must  conduct 
semi-annual  reviews  of  the  internal  controls  associated 
with  their  GCPC  programs. 

Lastly,  AHs  and  APCs  are  encouraged  to  establish  other 
controls,  as  they  see  fit,  to  help  limit  the  potential  for 
fraud,  abuse,  and  misuse  within  their  GCPC  programs. 
Although  the  internal  controls  described  in  the  preceding 
paragraphs  would  appear  sufficient  to  enable  GCPC  program 
administrators  to  effectively  manage  a  GCPC  program  and 
prevent  wide-spread  instances  of  fraudulent  use  of  GCPC 
program  cards,  they  often  have  not  sufficed;  the  2002  GAO 
Testimony  and  DoD  Report  detail  significant  weaknesses  in 
the  GCPC  program  internal  control  environment,  despite  the 
existence  of  those  internal  controls  listed  previously  and 
the  continuous  efforts  made  to  strengthen  them  since  the 
inception  of  the  GCPC  program. 

Although  it  is  not  the  purpose  of  this  report  to 
highlight  what  may  be  the  short-comings  of  existing  GCPC 
program  internal  controls,  we  believe  those  controls  have 
largely  been  aimed  at  limiting  the  opportunity  for 
individuals  to  commit  fraud,  misuse,  and  abuse  with  their 
GCPC  cards,  and  to  identify  fraud,  misuse,  and  abuse  when 
it  occurs.  While  certainly  an  instrumental  part  of  any 
internal  control  program,  the  use  of  controls  aimed  at 
denying  individuals  the  opportunity  to  commit  fraud  and  to 
quickly  identify  its  occurrence  is  in  and  of  itself  an 
incomplete  solution,  particularly  when  the  incentives  to 
commit  fraud  (in  the  case  of  the  GCPC  program,  the  ready 
access  to  large  amounts  of  government  credit)  can  not  be 
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eliminated.  Although  recent  efforts  to  improve  the 
training  provided  to  those  participating  in  the  GCPC 
program  may  in  fact  be  intended  to  prevent  individuals  from 
easily  rationalizing  illicit  purchases  and  misuse  of  their 
GCPC  program  cards,  we  believe  additional  measures  can  be 
implemented  to  combat  the  rationalization  leg  of  the  fraud 
triangle.  Before  we  detail  those  recommendations  however, 
we  will  first  describe  how  the  GCPC  program  creates  savings 
for  the  U.S.  Government  while  speeding  the  more  traditional 
military  acquisition  process. 
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III.  THE  GOVERNMENT- WIDE  COMMERCIAL  PURCHASE  CARD 
PROGRAM  SAVINGS  CREATION  AND  THE  ORDER- 
DOCUMENTATION-PAY  CYCLE 

A.  GCPC  PROGRAM  SAVINGS  CREATION 

The  purchase  card  program  was  designed  to  provide  a 
less  costly  and  more  efficient  way  for  all  the  DoD 
organizations  to  buy  goods  and  services.  By  authorizing 
cardholders  to  buy  low-cost  supplies  and  services  with  the 
GCPC  card,  the  DoD  has  been  able  to,  and  will  continue  to 
be  able  to,  leverage  its  resources  by  increasing  its 
efficiencies.  Through  the  GCPC  program,  DoD  components 
have  their  operating  needs  quickly  satisfied  at  reduced 
costs  . 

To  provide  an  illustrative  example  of  the  dramatic 
benefits  of  the  GCPC  program  to  Marine  Corps  operating 
forces  units,  one  need  only  remember  the  supply  process  for 
needed  items  not  held  in  current  unit  inventory  consumable 
supply  stocks  nor  available  at  Direct  Support  Stock  Control 
before  implementation  of  the  GCPC  program.  Prior  to  having 
GCPC  purchase  cards  in  units.  Marines  submitted  formal 
requests  for  required  items  through  their  chain  of  command. 
If  those  requests  were  approved  by  each  level  of  the  chain, 
they  were  then  answered  at  (at  the  minimum)  the 
Battalion/Group-level  supply  departments.  The  approval 
process  alone  could  take  several  days,  with  additional  time 
required  for  actual  purchase  and  delivery  of  the  requested 
items.  Today  through  use  of  the  GCPC  program  card,  units 
can  in  most  cases  immediately  satisfy  their  supply  needs. 
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the  same  day,  through  a  commercial  vendor,  without  the 
requirement  for  the  lengthy  approval  process. 

This  streamlining  of  the  acquisition  process  saves  the 
DoD  an  estimated  $20  for  every  item  purchased  with  the  card 
as  compared  to  the  former,  strictly  paper-based,  approval¬ 
laden  buying  process.^®  In  2002,  GCPC  cardholders  made  more 
than  ten  million  purchases  with  GCPC  program  cards,  saving 
the  government  in  excess  of  $200  million  in  administrative 
costs.  As  stated  by  Under  Secretary  of  Defense 
(Comptroller)  and  Chief  Financial  Officer  Dov  S.  Zakheim  at 
a  June  27,  2002  press  conference  in  regards  to  GCPC  program 
cards,  "they  really  are  essential  to  improving  business 
practices  . 

In  addition  to  saving  the  government  money  by 
streamlining  the  acquisition  process.  Citibank  also  has  a 
provision  in  its  purchase  card  contract  to  provide  the 
government  with  cash  rebates  or  refunds  for  early  or  on- 
time  payments.  This  refund  is  a  deduction  from  the  amount 
charged  or  a  return  of  part  of  the  price  paid  for  each 
purchase.  The  rebate  or  refund  computation  formula  is 
included  in  the  purchase  card  contract;  the  rebate  amount 
is  calculated  monthly  by  Citibank  for  all  purchases  made 
with  DoD  GCPC  program  cards  and  verified  by  DFAS .  Rebates 
or  refunds  attributable  to  the  use  of  the  government 
purchase  cards  are  credited  to  operation  and  maintenance 
(O&M)  accounts  of  the  DoD.  Although  individual  units  don't 
receive  the  rebates,  which  would  in  effect  increase  their 


1 6 .  WWW . acq . osd.mil/dp/docs2002/Purchase_Card_Questions_Answers_doc 

17.  Defense  Link,  DoD  Moves  to  Improve  Charge  Card  Programs,  27  Jun  2002. 
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O&M  purchasing  power,  the  savings  to  DoD  can  be 
substantial.^^  Figure  4  shows  the  rebate  savings  amounts 
calculated  (in  thousands)  through  September  2003. 


FY 

D3  DoD  Purchase  Card  Usage  US  Bank  and 
Citibank 

Total 

Accounts 

Fiscal  Year  thru  30  Sep  03 

TOTAL 

Agency 

B/O 

C/H 

Sales 

Transactions 

Rebates 

Navy 

(17) 

*4, 823 

19, 807 

$1, 853, 181 

2,539 

$4, 436 

Army 

(21) 

26,202 

66, 922 

$3, 026, 240 

4,510 

$19, 837 

Air 

Force 

(57&58) 

19,294 

47,437 

$1, 757, 483 

3,  018 

$14, 039 

Defense 

Agencies 

(97) 

3,  108 

7,207 

$  599,072 

666 

$2,769 

Totals 

53,427 

141,373 

$7,235, 977 

10, 735 

$  36,082 

1  1 

Figure  4.  FY-03  DoD  Purchase  Card  Usage,  31  October  2003 
(From:  http : / / pur chase card . saalt . army .mil/ 03metrics . htm) 

B.  THE  ORDER-DOCUMENTATION-PAY  CYCLE 

Perhaps  the  greatest  success  of  the  GPCP  program,  as 
well  as  the  basis  for  much  of  its  cost  effectiveness,  is 
the  savings  enjoyed  by  the  DoD  in  man-hours  required  to 
administer  low-dollar  value  acquisitions  throughout  the 
department.  The  current  program's  use  of  electronic 
billing  and  reconciliation  processes  has  been  a  dramatic 
improvement  over  the  initial  GCPC  program  manual  processes. 
Prior  to  1998,  the  GCPC  program  billing,  reconciliation, 

18.  DoD  Financial  Management  Regulation  7000. 14R 
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and  payment  process  consisted  of  six  steps: 

1)  Cardholder  purchases  and  receives  item  from 
merchant.  The  Merchant's  bank  processes  card  transactions 
and  the  card-issuing  bank  pays  the  merchant. 

2)  Card-issuing  bank  mails  monthly  paper  statements  to 
cardholder  and  approving  official. 

3)  Cardholder  reconciles  statement. 

4)  Cardholder  attaches  supporting  documentation  and 
submits  reconciled  statement  to  approving  official. 

5)  Approving  official  reviews  purchases,  approves  and 
certifies  invoice,  and  mails  certified  invoice  to  the 
paying  office. 

6)  Paying  office  electronically  transmits  payment  to 
card-issuing  bank.^® 

Under  this  paper-based  and  mail-reliant  process,  the 
ability  to  review  transactions  was  limited  to  the  end  of 
the  billing  cycle,  when  the  paper  statements  were  received 
by  both  the  cardholders  and  their  approving  officials.  If 
a  mail  delay  occurred  for  any  reason,  the  entire 
reconciliation  and  payment  process  would  be  delayed, 
potentially  adding  weeks  to  the  time  between  the  bank' s 
forwarding  of  the  invoice  and  its  receipt  of  final  payment. 
Any  such  delay  significantly  increased  the  potential  for 
violation  of  the  Prompt  Payment  Act,  with  corresponding 
interest  payments  having  to  be  made  to  the  GCPC  program 
card  issuers  as  well  as  the  loss  to  the  government  of  any 
rebates  based  on  timely  payment  of  GCPC  program  card  bills. 


19.  Testimony  of  Mr.  Bruce  Sullivan. 
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In  1998,  the  GSA  re-competed  the  contract  for  GCPC 
services.  As  a  result  of  that  competition,  the  program  now 
includes  an  internet -based  capability  to  setup,  manage,  and 
cancel  GCPC  program  card  accounts  as  well  as  to  review,  in 
real  time,  credit  card  transactions  as  they  post  to  the 
banks'  systems.  This  on-line  capability  also  allows  GCPC 
cardholders  to  reconcile  and  certify  their  accounts  only 
one  day  after  the  end  of  the  billing  cycle  and  to  forward 
those  certifications  to  their  respective  approving 
officials.  AOs  are  also  able  to  certify  all  of  their 
cardholder  accounts  on-line  and  forward  their 
certifications  electronically  to  the  card  issuer.  Through 
the  internet,  on-line  certification  can  occur  weeks  before 
paper  billing  statements  are  even  received  by  the 
cardholders  and  AOs. 

Upon  receipt  of  an  AO's  certification,  the  bank 
reformats  the  invoice,  summarizes  (or  rolls  up)  all  of  the 
cardholders'  transactions  by  lines  of  accounting,  and 
transmits  the  certified  invoice  to  the  supporting  finance 
and  accounting  system.  The  Defense  Finance  and  Accounting 
Service  (DFAS)  electronically  processes  the  invoices  and 
pays  the  bill.  Through  electronic  certification  and 
payment,  DFAS  has  lowered  the  rate  it  charges  its  DoD 
Component  customers  for  bill-paying  services  by  as  much  as 
sixty  percent,  or  approximately  $20  per  transaction. 

Another  benefit  of  the  on-line  approval  and 
certification  process  is  that  it  ultimately  enhances 
internal  controls  by  instilling  greater  discipline  in  the 
program.  The  timeliness  and  detail  of  information 
available  concerning  GCPC  transactions  enhances  the  ability 
of  cardholders,  AOs,  and  APCs  to  effectively  manage  their 
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programs.  Invoices  do  not  get  paid  unless  cardholders  and 
AOs  reconcile  their  accounts,  and  APCs  are  able  to  almost 
effortlessly  track  current  account  and  reconciliation 
status' .  Additionally,  the  on-line  process  decreases 
delinquencies  and  Prompt  Payment  Act  interest  penalties 
since  it  enables  invoices  to  be  certified  within  a  few  days 
of  the  end  of  the  billing  cycle  date,  removing  the  impact 
of  any  mail  delays  between  geographically  separated  card¬ 
issuing  banks,  certifying  officials,  and  payment  offices. 

Currently,  over  eighty  percent  of  Marine  Corps 
purchase  card  invoices  are  paid  by  use  of  the  electronic 
billing,  reconciliation,  and  payment  process.  The  2002  DoD 
Charge  Card  Task  Force  recommended  that  every  government 
agency  accelerate  the  electronic  certification  and  bill 
paying  systems  for  purchase  cards,  or  obtain  waivers  from 
the  Component's  chief  financial  officer  and  acquisition 
executive . 
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IV.  2002  REVIEWS  OF  THE  GOVERNMENT-WIDE  COMMERCIAL 

PURCHASE  CARD  PROGRAM 


A.  THE  2002  DOD  CHARGE  CARD  TASK  FORCE  FINAL  REPORT 

Issued  on  June  27,  2002,  the  DoD  Charge  Card  Task 
Force  Final  Report  highlighted  several  problems  with  DoD 
charge  card  programs  (including  the  GCPC  program)  as  well 
as  recommending  solutions  to  those  problems.  The  problems 
the  report  listed  included  misuse,  abuse,  and  fraud 
attributed  to  poorly  enforced  internal  controls.  The 
report  also  recommended  strengthening  those  controls  and: 

enhancing  the  capability  of  the  workforce  to 

2  0 

accomplish  assigned  charge  card  responsibilities 

The  report  recognized  that  the  decentralization  of 
procurement  authority  (for  micro-purchases)  from 
contracting  organizations  had  increased  the  potential  for 
purchase  authority  to  be  vested  in  individuals  lacking 
procurement  training  and  experience The  report  stated 
that : 


Among  the  most  critical  management  controls  in 
the  purchase  card  program  are  the  monthly  review 

and  approval  of  the  cardholder' s  statement  by  the 

22 

approving  official. 

The  report  highlighted  two  areas  of  concern  relevant 
to  the  GCPC  program:  misuse/abuse  of  the  cards  and  late 
payment  of  card  balances.  Card  misuse/abuse  included: 


20.  2002  DoD  Charge  Card  Task  Force  Final  Report,  p.  vi 

21.  2002  DoD  Charge  Card  Task  Force  Final  Report,  pp.  2-5 

22.  2002  DoD  Charge  Card  Task  Force  Final  Report,  pp.  2-4 
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split  purchases  to  exceed  spending  limits;  purchase  of 
prohibited  goods  and  services;  purchase  of  items  for  non¬ 
governmental  use  or  that  do  not  represent  best  value  to  the 
government;  failure  of  the  review  process  while  certifying 
invoices;  fraud;  and  failure  to  properly  receipt  and 
account  for  purchased  items.  The  report  listed  the  primary 
cause  for  card  misuse/abuse  as  the  failure  of  local 
organizations  to  implement  available  internal  controls, 
leading  to  several  weaknesses  in  the  internal  control 
environment  which  included:  unmanageable  spans  of  control 
and  excessive  numbers  of  cardholders;  inadequate  training 
for  cardholders  and  approving  officials;  inadequate  review 
of  purchases;  failure  to  use  required  supply  sources;  lack 
of  documentation  and  accounting  for  purchases;  and 
cardholder  misuse  of  cards,  including  fraudulent  purchases 
and  exceeding  card  limits. 

Although  intentional  misuse  may  not  be  preventable, 
the  report  indicated  that  effective  internal  controls  are 
the  key  to  identifying  any  such  misuse,  thereby  limiting  it 
(ideally)  to  one  billing  cycle,  and  to  correcting  the 
various  program  deficiencies  annotated  in  the  report.  The 
report  did  note  the  actions  which  DoD  had  already  taken  to 
strengthen  the  purchase  card  program.  Those  actions 
included:  limiting  the  approving  official  to  cardholder 
ratio  to  1:7;  lowering  card  spending  limits;  blocking 
unneeded  merchant  category  codes  for  individual  cards 
(thereby  tailoring  the  card  to  the  types  of  purchases 
normally  required  by  the  organization) ;  and  expanding  audit 
coverage.  The  report  also  recognized  DoN  initiatives  to 
emphasize  program  accountability,  improve  training  and 
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reinforce  training  requirements,  and  ensure  the  adequacy  of 
local  internal  controls. 

Additionally,  the  report  noted  the  importance  of 
organizational  culture  in  the  operation  of  an  effective 
purchase  card  program,  specifically  highlighting  the  need 
for  adequate  resources  (individuals  assigned  to  management 
of  the  program)  to  be  devoted  to  the  program.  Included  in 
the  need  for  adequate  resources  were  standardization  of  APC 
skill  sets  and  the  establishment  of  mandatory,  standardized 
training  for  all  personnel  involved  in  the  purchase  card 
program . 

Further,  the  Task  Force  recommended  accelerating 
implementation  of  electronic  billing,  enabling  on-line 
statement  review,  approval,  and  certification  as  a  method 
to  resolve  the  problem  with  late  bill  payment,  and 
enhancing  fraud  detection  capabilities  through  the  use  of 
data-mining . 

Citibank  offers  a  powerful  suite  of  automated  tools 
that  APCs  can  use  to  conduct  an  on-line  statement  review, 
approval,  and  certification  of  all  cardholder  accounts. 
These  on-line  tools  aid  in  resolving  problems  associated 
with  late  payments,  interest  penalties,  and  the  loss  of 
rebates.  These  electronic  capabilities  provide  APCs  with 
the  capability  to  review  transactions  in  near  real-time 
and,  according  to  the  Report,  permit  approving  officials  to 
perform  continuous  reviews  into  each  of  their  cardholder 
accounts  during  the  billing  cycle,  preventing  a  last  minute 
deluge  of  receipts  and  invoices  associated  with  the  end  of 
month  reconciliation  process. 

Currently,  eighty  percent  of  all  Marine  Corps  accounts 
are  utilizing  the  on-line  certification  process.  According 
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to  the  DoN  E-Business  Operations  Office,  the  reasons  not 
all  units  use  the  electronic  review  and  certification 
capabilities  right  now  are:  some  deployed  units  are  without 
internet  access;  some  units  located  outside  the  continental 
United  States  cannot  maintain  high  enough  quality 
connectivity  to  the  internet  to  permit  reliable  use  of  the 
systems  electronic  capabilities;  and  the  bank's  online 
certification  system  does  not  accommodate  all  DoD 
accounting  systems,  necessitating  certain  units  to  certify 
their  billing  statements  manually. 

Despite  these  unresolved  problems,  the  internet  is 
available  at  most  locations  worldwide,  including  aboard 
nearly  all  of  the  U.S.  Navy's  ships.  Additionally,  with 
DoD  initiatives  to  standardize  all  DoD  accounting  systems, 
many  of  the  current  limitations  to  electronic  review  and 
billing  statement  certification  will  become  less  prevalent 
in  the  future . 

Lastly,  the  report  recommended  clarifying  and 
strengthening  sanctions  for  non-compliance  with  internal 
controls,  including:  applying  pecuniary  liability  to 
cardholders  and  approving  officials;  increasing  prosecution 
of  cases  of  fraud;  and  strengthening  compliance  language  in 
existing  regulations  through  consolidation  of  existing 
guidance  and  reiteration  of  the  potential  penalties  for 
card  misuse  and  non-compliance  with  internal  controls.  In 
its  specific  recommendations,  the  task  force  recommended 
DoD : 

Develop  methods  to  assure  more  positive  control 

of  charge  cards  when  an  individual  leaves  an 

■  ■  2  3 

organization . 


23.  2002  DoD  Charge  Card  Task  Force  Final  Report,  recommendation  CO-3 
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B.  THE  2002  GAO  TESTIMONY  BEFORE  THE  SUBCOMMITTEE  ON 
GOVERNMENT  EFFICIENCY,  FINANCIAL  MANAGEMENT  AND 
INTERGOVERNMENTAL  RELATIONS,  COMMITTEE  ON  GOVERNMENT 
REFORM,  HOUSE  OF  REPRESENTATIVES,  REGARDING  NAVY 
VULNERABILITIES  TO  FRAUD  AND  ABUSE  IN  THE  PURCHASE 
CARD  PROGRAM 


The  2002  GAO  testimony  stated  that 

the  control  weaknesses  we  identified  at  the  two 
Navy  units  in  San  Diego  were  representative  of 
systemic  Navy-wide  purchase  card  control 
weaknesses^^ 

The  control  weaknesses  were  systemic  within  the  entire 
DoN,  to  include  the  Marine  Corps.  The  GAO  testimony 
highlighted  several  weaknesses  which  echoed  those 
identified  by  the  DoD  Charge  Card  Task  Force.  The 
testimony  stressed  the  need:  for  cultural  change  within  the 
DoN  to  improve  management  attention  toward  the  purchase 
card  program;  to  ensure  reasonable  spans  of  control  among 
APCs  and  AOs;  to  limit  credit  levels  to  historic  needs;  and 
to  improve  training  at  all  levels  of  the  program.  The  GAO 
also  noted  that  credit  limits  were  commonly  established 
arbitrarily  instead  of  being  based  upon  unit  historical 
spending  and  that  training,  though  available,  was  often  not 
being  documented  for  individuals  involved  in  the  purchase 
card  program.  Nor  was  the  existing  training  tailored  to 
the  differing  needs  of  individuals  performing  different 
functions  within  the  program. 

The  GAO  testimony  further  stated  that  there  were 
insufficient  (human)  resources  devoted  to  monitoring  and 
oversight  of  the  GCPC  program,  resulting  in  the  inability 

24,  2002  GAO  Testimony,  p.  2. 
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of  APCs  and  AOs  to  effectively  audit  their  programs.  It 
also  noted  failures  in  implementation  of  internal  controls, 
to  include  failing  to  screen  for  required  vendors, 
weaknesses  in  documentation  and  acceptance  of  items,  and 
non-reconciliation  of  statements  prior  to  certification. 
The  testimony  highlighted  the  occurrence  of  three  types  of 
improper  purchases  by  GCPC  cardholders:  purchases  not 
serving  an  authorized  governmental  purpose;  split 
purchases;  and  purchases  from  improper  sources. 

However,  the  GAO  did  note  the  DoN  recognized  the 
deficiencies  in  GCPC  program  administration,  stating  that 
the : 


Navy  has  taken  action  or  said  it  plans  to 
implement  all  29  of  our  recommendations  to 
improve  controls  over  the  purchase  card  program. 


C.  GCPC  PROGRAM  WEAKNESSES  AND  RECOMMENDATIONS 

The  many  GCPC  program  weaknesses  identified  within  the 
2002  DoD  Charge  Card  Task  Force  Final  Report  and  GAO 
Testimony  were  seen  to  be  common  throughout  DoD,  DoN,  and 
Marine  Corps  purchase  card  programs.  The  identification  of 
those  weaknesses,  coupled  with  recommendations  to  alleviate 
them,  helped  strengthen  the  GCPC  program  internal  control 
environment  as  corrective  actions  were  implemented  to 
address  those  internal  control  weaknesses.  For  instance, 
our  interview  with  the  Marine  Corps  Air  Station  Miramar  APC 
confirmed  the  positive  effect  of  the  increased  use  of 
electronic  certification  in  solving  the  problem  of  late 

25.  2002  GAO  Testimony,  p.  3. 
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cert if icat ion  of  Citibank  invoices.  Although  noting  a 
still  existing  problem  with  AO  turnover,  this  APC  confirmed 
she  no  longer  experienced  late  certifications  from  those 
AOs  performing  electronic  certification  of  invoices.^® 

In  addition  to  enabling  on-line  review  and 
certification  of  billing  statements,  other  improvements  to 
the  GCPC  program  have  included:  creation  of  data-mining 
capabilities  through  Citibank;  limitation  to  the  spans  of 
control  of  those  involved  in  a  GCPC  program;  improvements 
to,  and  tailoring  of,  GCPC  training  programs;  and  increased 
management  attention  paid  to  the  administration  of  GCPC 
programs  throughout  the  DoD.  However,  as  we  have  stated 
previously,  these  improvements  appear  principally  directed 
at  limiting  the  opportunity  for  individuals  to  commit  fraud 
by  use  of  GCPC  program  cards  and  to  quickly  identify  any 
fraud  or  card  misuse  once  it  occurs.  Undoubtedly,  these 
initiatives  have  strengthened  the  GCPC  internal  control 
environment.  But  rather  than  attempting  to  gain  even 
further  ground  in  limiting  the  opportunity  for  fraud  or 
enhancing  detection  capabilities,  the  recommendations  made 
in  the  concluding  chapter  of  this  report  are  directed 
against  a  different  aspect  of  the  "fraud  triangle, "  that  of 
rationalization.  By  lessening  the  potential  for  GCPC 
program  cardholders  and  administrators  to  rationalize 
wrongful  use  of  GCPC  purchase  cards,  the  Marine  Corps,  DoN, 
and  DoD  may  improve  the  current  GCPC  program  internal 
control  environment. 


26.  Interview  with  Ms.  Denice  Parks,  APC,  MCAS  Miramar,  21  August  2003. 
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V. 


RECOMMENDATIONS  AND  CONCLUSION 


A.  RECOMMENDATIONS 

The  benefits  of  the  GCPC  program  are  numerous  and 
include : 

1)  Providing  commercial  credit  cards  and  associated 
services  in  support  of  official  government  purchases. 

2)  Streamlining  ordering,  payment  and  procurement 
procedures,  reducing  administrative  processing  costs. 

3)  Improving  government  micro-purchase  procurement 
operations  and  accountability. 

4)  Lowering  the  costs  associated  with  micro-purchase 
and  other  commercial  transactions. 

5)  Reducing  the  administrative  paperwork  associated 
with  acquisition  through  governmental  supply  and 
acquisition  channels. 

6)  Providing  a  wide  variety  of  options  when  procuring 
items  from  commercial  vendors. 

7)  Supporting  operational  forces'  high  operational 
tempo  and  worldwide  commitments  by  empowering  commanders 
with  micro-purchase  authority. 

To  improve  the  efficiency  of  the  GCPC  program,  the 
DoD,  the  DoN,  and  the  Marine  Corps  have  taken  many  steps  in 
the  recent  past  to  strengthen  the  internal  controls 
associated  with  GCPC  program  management.  Training  modules 
are  now  available  on-line  and  are  tailored  to  the  differing 
needs  of  individuals  performing  different  functions  at 
different  levels  within  the  GCPC  program,  making  the 
required  training  both  more  accessible  and  more  useful  to 
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individuals.  Cardholders  and  approving  officials  are  able 
to  electronically  review  and  certify  monthly  billing 
statements,  helping  to  negate  the  potential  for  late 
payments  to  Citibank.  By  mid-2003,  the  Marine  Corps  had 
reduced  its  number  of  active  cardholders  by  over  half,  from 
nearly  6,000  to  2,806.^^  Elimination  of  unneeded  cardholder 
accounts  greatly  improves  the  ability  of  AOs  and  APCs  to 
manage  the  active  accounts  within  their  areas  of 
responsibility  and  thus  improves  the  likelihood  of 
effective  program  management. 

However,  there  remain  weaknesses  in  the  internal 
controls  of  the  unit-level  GCPC  programs,  which  we  believe 
could  be  readily  improved.  Our  recommendations  to  further 
improve  the  GCPC  program  are  to: 

1)  Convert  the  GCPC  cards  from  individually  named 
credit  cards  to  unit  cards  with  personalized  numbers. 

2)  Change  the  appearance  of  the  cards. 

3)  Control  the  number  of  cards  within  each  unit  by 
authorizing  level  five  APCs  to  define  and  implement  "best 
practice"  controls. 

4)  Provide  electronic  receipts  of  all  cardholder 
transactions  daily  to  AOs  and  APCs. 


27.  Headquarters,  Marine  Corps,  Purchase  Card  Semi-Annual  Review,  October  1,2002  - 
March  30,  2003 
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1 .  Recommendation  #1 :  Convert  the  GCPC  Cards  from 
Individually  Named  Credit  Cards  to  Unit  Cards 
with  Personalized  Numbers . 

The  DoD  utilizes  two  types  of  credit  card  accounts: 
Centrally  Billed  Accounts  (CBAs)  and  Individually  Billed 
Accounts  (IBAs) .  CBAs  are  normally  used  by  organizations 
to  centrally  procure  travel  services  (such  as  buying 
airline  tickets) .  The  bank  issues  CBAs  to  DoD 
organizations,  and  the  payment  of  billed  charges  is  solely 
a  governmental  liability.  IBAs  are  government  charge  cards 
issued  to  military  members  and  DoD  civilian  employees  with 
their  names  embossed  on  the  front  of  the  cards.  The 
individual  cardholder  is  responsible  for  the  prompt 
payment,  in  full,  of  the  amount  stated  on  the  monthly 
billing  statement  and  can  be  held  criminally  liable  for  any 
fraud  committed  against  the  government  by  use  of  the  card, 
and  for  other  misuse  or  abuse  of  the  card.  However,  when 
an  authorized  cardholder  (someone  assigned  in  writing  to 
conduct  purchases  for  the  government)  makes  a  purchase  with 
a  card,  whether  the  purchase  is  appropriate  or 
inappropriate,  the  government  is  also  legally  liable  for 
payment  to  the  card  issuer. 

GCPC  purchase  cards  are  issued  with  the  cardholder' s 
name  embossed  on  them  as  an  internal  control  measure. 

Since  only  the  individual  cardholder  can  make  purchases 
with  the  card  (as  only  his  name  is  on  it),  it  is  relatively 
simple  to  establish  who  made  a  questionable  purchase. 
However,  since  the  cards  are  similar  in  appearance  to  non¬ 
government  credit  cards  and  since  the  individual's  name 
appears  on  the  card,  there  is  a  risk  that  an  individual  may 
mistake  the  GCPC  card  for  his  personal  credit  card  or  be 
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able  to  rationalize  illicit  use  of  the  GCPC  program  card  as 
it  is  "his"  because  it  bears  his  name. 

Additionally,  by  issuing  purchase  cards  to  individual 
Marines  with  their  names  embossed  on  the  cards,  the  Marine 
Corps  is  recognizing  those  cardholders  as  possessing 
sufficient  maturity,  responsibility,  and  competence  to 
conduct  commercial  financial  transactions  on  behalf  of  the 
government.  As  those  assigned  as  cardholders,  particularly 
in  operational  forces  units,  are  likely  to  be  very  junior 
Marines  within  the  unit,  this  high  level  of  trust  may  not 
be  commensurate  with  their  actual  personal  financial 
situations  or  maturity  levels;  the  incentives  associated 
with  access  to  large  amounts  of  government  credit  may  in 
fact  create  significant  levels  of  temptation  to  commit 
fraud  while  also  providing  a  ready  source  of 
rationalization.  Particularly  for  individuals  with  little 
experience  in  financial  management  prior  to  entering  the 
service,  the  issuance  of  a  credit  card  with  their  name  on 
it,  which  looks  strikingly  similar  to  a  personal  credit 
card,  may  be  providing  them  an  undeserved  sense  of 
entitlement  to  the  use  of  the  card.  It  is  also 
unnecessary . 

In  contrast,  when  administering  unit  (CBA)  credit 
cards,  the  determination  of  who  made  an  actual  illicit 
purchase  can  be  a  much  more  difficult  endeavor  as  many 
individuals  may  have  access  to  a  particular  card,  even 
during  the  course  of  a  single  day.  However,  it  is  much 
more  difficult  for  an  individual  to  rationalize  misuse  of  a 
unit  card  as  it  does  not  bear  his  name.  Additionally,  unit 
cards  have  to  be  accounted  for  by  the  unit  to  which  the 
card  is  issued,  and  improper  use  of  unit  cards  personally 
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reflects  on  the  commander  of  the  unit  as  the  cards  are 
directly  under  his  control,  not  circuitously  through  the 
AO/APC  hierarchy. 

DoN' s  current  service  contract  with  Citibank  does  not 
limit  the  Marine  Corps  in  the  structure  of  its  GCPC  card 
accounts,  meaning  whether  the  cards  are  issued  to 
individuals  or  to  organizations  is  determinable  by  the 
Marine  Corps.  For  this  reason,  the  Marine  Corps  can  tailor 
its  GCPC  program  to  incorporate  the  benefits  of  unit  cards 
with  the  pecuniary  control  mechanisms  associated  with 
individually  issued  credit  cards.  By  issuing  the  GCPC 
program  cards  with  unit  identifiers  instead  of  personal 
names  embossed  on  the  front  of  the  cards  while  associating 
card  numbers  to  individual  cardholders,  the  Marine  Corps 
can  negate  much  of  the  potential  for  rationalization 
inherent  in  the  current  program  while  maintaining  a  high 
level  of  card  use  accountability.  To  accomplish  this  would 
require  modification  to  the  current  GCPC  cards. 

The  authors'  recommendation  for  a  revised  GCPC  unit 
card  is  depicted  in  Figure  (6) .  The  card  would  still  be 
issued  directly  from  Citibank  to  the  cardholder,  but  would 
not  bear  the  cardholder's  name.  For  accountability  and  to 
establish  pecuniary  responsibility  to  the  cardholder,  the 
last  four  digits  of  the  card  would  be  used  to  identify  the 
individual  cardholder.  APCs  and  HAs  would  have  increased 
interest  in  ensuring  detaching  cardholders  returned  their 
cards  and  had  their  accounts  deactivated  as  the  cards  would 
be  directly  associable  to  the  unit  instead  of  to  the 
individual  cardholder.  As  is  true  of  the  program  as 
currently  administered,  the  cardholder  would  have  sole 
access  to  his  GCPC  card  while  serving  as  a  cardholder,  yet 


one  potential  source  of  the  ability  of  a  cardholder  to 
rationalize  illicit  purchases  (believing  the  card  to  be  his 
because  his  name  is  on  it)  would  be  eliminated. 

The  existence  of  GCPC  cards  with  unit  names  instead  of 
individual  names  embossed  on  the  fronts  of  the  cards  should 
also  have  the  positive  effect  of  increasing  the  attention 
HAS  pay  to  who  they  designate  as  cardholders.  Fraud, 
misuse,  or  abuse  of  a  card  would  reflect  negatively  on  the 
unit  and  its  commander,  instead  of  being  primarily  limited 
to  reflecting  upon  the  individual  cardholder. 

Additionally,  statistical  metrics  could  more  readily  be 
devised  to  accentuate  poorly  managed  unit  GCPC  programs . 

2  .  Reconunendation  #2 :  Change  the  Appearance  of  the 
Cards 

According  to  the  Camp  Pendleton  APC,  cardholders  had 
sometimes  explained  that  their  illicit  GCPC  program  card 
purchases  were  simple  mistakes  made  because  their  GCPC 
program  cards  looked  too  much  like  their  other,  personal 
credit  cards.  Changing  the  GCPC  program  card  appearance  to 
make  it  more  distinctive  is  an  obvious  solution  to  this 
type  of  confusion  experienced  by  cardholders.  The  current 
GCPC  program  card,  depicted  in  Figure  (5) ,  is  very  visually 
appealing  and  contains  the  sentence  "For  Official  US 
Government  Purchases  Only"  in  faint,  extremely  small  print 
under  a  large  heading  reading  "United  States  of  America." 

In  addition  to  GCPC  cardholder  confusion,  vendors  seeing 
the  large  "VISA"  symbol  and  the  embossed  cardholder's  name 
can  themselves  easily  overlook  the  tiny  official  purchase 
warning . 
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Although  one  benefit  of  the  current  appearance  of  the 
GCPC  card  is  likely  its  unquestioned  acceptance  by 
commercial  vendors  as  it  looks  largely  like  any  other 
personal  credit  card,  the  card' s  appearance  can  be  modified 
to  eliminate  any  cardholder  perception  that  the  card  isn't 
as  "official"  as  it  is  in  reality.  Figure  (6)  is  the 
author's  redesign  recommendation.  This  card,  while  still 
looking  somewhat  like  a  personal  credit  card  would  bear  the 
issuing  unit's  name  instead  of  the  individual  cardholder's 
name  and  state  in  large  print  "FOR  OFFICIAL  US  GOVERNMENT 
PURCHASES  ONLY,  CARDHOLDER  VIOLATIONS  SUBJECT  TO  31  U.S.C 
3528".  We  believe  a  cardholder  would  find  it  much  more 
difficult  to  rationalize  illicit  purchases  with  such  a 
redesigned  GCPC  card. 
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The  GCPC  program  card  of  today: 


The  current  GCPC 
promotes 

personal  spending  and 
minimizes 
accountability  by 
user' s  and  Unit 
Commanders . 


Figure  5.  The  Current  GCPC  Purchase  Card. 


The  GCPC  program  card  of  tomorrow: 


A  distinctive  appearance  with  a  very  readable  header  with 
the  following: 


UNITED  STATES  OF  AMERICA 
FOR  OFFICIAL  US  GOVERNMENT  PURCHASES  ONLY 
CARD  HOLDER  VIOLATIONS  SUBJECT  TO  31  U.S.C  3528 


These  last  four  digits 
would  be  different  for 
every  user;  the  numbers 
will  identify  the  card' s 
authorized  user 


The  unit  name  would 
replace  the  individual 
cardholder' s  name  here 


Figure  6.  Proposed  GCPC  Purchase  Card. 
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3. 


Recoimnendation  #3 :  Control  the  Number  of  Cards 
Within  Each  Unit  by  Authorizing  Level  Five  APCs 
to  Define  and  Implement  Best  Practice  Controls 


As  of  the  writing  of  this  report,  the  Marine  Corps  had 
2,806  Cardholders,  1,310  AO's,  and  120  APC's.  This  level 
of  GCPC  program  administrators  represents  a  ratio  of  23 
cardholders  per  APC  and  2.15  cardholders  per  AO,  ratios 
well  within  the  mandated  spans  of  control  of  three  hundred 
cardholders  per  APC  and  seven  cardholders  per  AO.  However, 
according  to  the  2002  DoD  Charge  Card  Task  Force  Final 
Report : 

there  is  no  standard  span  of  control  for  the 
Agency  Program  Coordinator's  (APCs) .  The  number 
of  purchase  card  accounts  assigned  to  an  APC 
should  be  limited  to  a  number  that  allows  for 
proper  administration  of  the  purchase  card 
program  and  execution  of  the  internal  control 
functions  . 

The  Task  Force  recommended  a  best  practice  approach  to 
determining  the  appropriate  number  of  cardholders  within  a 
unit  rather  than  establishment  of  a  specific  number  for  all 
units  administering  GCPC  programs.  However,  best  practice 
appears  to  be  an  undefined  concept. 

One  can  surmise  that  best  practice  should  include  not 
only  a  determination  of  how  many  cardholders  are  needed  to 
provide  a  certain  level  of  purchasing  services,  but  also 
include  analysis  of  such  things  as  how  well  cardholders  are 
trained,  managed,  supervised,  and  disciplined  if  fraud  or 
card  misuse  occurs.  The  best  practice  conceivably  starts 
with  each  unit  justifying  a  need  for  a  cardholder,  ensuring 

28.  DoD  Charge  Card  Task  Force  Final  Report,  p.  2-12, 
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cardholders  are  properly  trained,  and  having  AOs  ensure 
their  cardholders  adhere  to  GCPC  program  guidelines. 

The  level  five  APC  is  ultimately  responsible  for  the 
success  of  a  local  GCPC  program;  therefore  APCs  should 
determine  what  constitutes  best  practice  within  their  spans 
of  control  and  thus  be  empowered  to  decide  how  many 
cardholders  are  required  within  their  units.  The  level 
five  APC,  most  responsible  for  the  day-to-day  operation  of 
a  unit  GCPC  program,  is  the  individual  best  able  to 
determine  GCPC  program  managerial  needs  for  his  unit. 

For  example,  if  a  unit  makes  on  average  one  hundred 
GCPC  purchases  per  month,  the  APC  might  determine  the 
unit's  cardholder  requirement  to  be  only  two  cardholders. 

If  the  unit's  requirement  for  commercial  micro-purchases 
were  to  increase,  necessitating  the  assignment  of  an 
additional  cardholder  within  the  unit,  the  HA  would  justify 
such  increase  to  the  APC  in  writing.  Conversely,  should 
the  unit's  purchase  card  usage  dramatically  drop,  the  APC 
would  notify  the  HA  that  one  of  the  active  cardholder 
accounts  would  be  deactivated.  The  unit  APC,  the 
individual  in  the  best  position  to  monitor  the  daily 
purchase  card  activity  of  the  unit,  should  be  empowered  to 
fully  manage  the  local  program. 

This  recommendation  is  designed  to  strengthen  unit 
GCPC  program  internal  management  controls  by  increasing  the 
administrative  burden  involved  in  justifying  excess  numbers 
of  cardholders  within  individual  units.  Currently,  units 
can  keep  their  numbers  of  cardholder  accounts  unnecessarily 
large  without  having  to  justify  the  number  of  their 
accounts,  as  long  as  they  do  not  exceed  the  mandated  ratios 
of  cardholders  to  AOs  and  APCs. 
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4 .  Provide  Electronic  Receipts  of  All 

Cardholder  Transactions  Daily  to  AOs  and 
APCs 

As  stated  in  the  DoD  Task  Force  Final 
Report : 

the  most  critical  management  controls  in  the 

purchase  card  program  are  the  monthly  review  and 

approval  of  the  cardholder' s  statement  by  the 

2  9 

approving  official. 

As  previously  discussed  in  this  report.  Citibank 
provides  an  on-line  capability  to  data-mine  account 
transaction  activity  for  all  GCPC  accounts.  Currently, 

APCs  and  AOs  are  required  to  review,  and  for  the  AOs  to 
certify,  their  cardholder's  accounts  on  a  monthly  basis. 

Yet  technology  could  easily  make  review  of  account  statuses 
a  daily  activity  for  APCs  and  AOs.  By  providing  them  an 
account  summary  on  a  daily  versus  monthly  basis,  the  GCPC 
program  control  environment  can  be  improved. 

APCs  and  AOs,  screening  their  cardholder  transactions 
daily,  would  no  longer  face  the  deluge  of  end  of  billing 
cycle  verifications  which  presently  confront  them.  This 
monthly  deluge,  along  with  the  requirement  to  quickly 
complete  the  verification  and  certification  processes,  can 
tempt  GCPC  program  administrators  to  perform  a  less  than 
detailed  review  of  their  cardholder's  monthly  transactional 
activities.  By  reviewing  the  day's  transactions  that  day, 
APCs  and  AOs  would  be  able  to  more  readily  identify 
questionable  transactions;  the  necessity  to  review 
transactions  daily  would  add  a  level  of  discipline  to  the 
present  review  and  certification  process.  Since  the 

29.  DoD  Charge  Card  Task  Force  Final  Report,  p.  2-4. 
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requirement  to  review  and  certify  all  cardholder 
transactions  already  exists,  daily  review  only  disciplines 
instead  of  adding  to,  current  requirements. 


Additionally,  cardholders,  well  aware  that  each 
transaction  would  be  reviewed  by  both  the  AO  and  the  APC 
the  day  the  purchase  was  made,  would  be  less  able  to 
rationalize  questionable  purchases.  The  knowledge  that  any 
such  purchases  would  be  more  likely  to  be  immediately 
identified  would  help  negate  the  potential  for  cardholders 
to  self-justify  illicit  card  use  by  believing  such  use  to 
be  unlikely  to  be  detected. 

B.  CONCLUSION 

Fraud  may  not  be  fully  preventable  in  any  procurement 
process  or  program.  Some  incentive  will  always  exist  to 
steal,  as  will  some  opportunity  to  commit  fraud.  Likewise, 
even  well  designed  internal  controls  have  little  impact  in 
preventing  fraud  if  they  are  not  effectively  implemented. 
Because  of  these  factors,  some  of  the  internal  controls 
designed  for  use  in  the  GCPC  program  may  not  have  had  as 
great  an  affect  in  limiting  GCPC  program  fraud  or  card 
misuse  as  originally  intended;  certainly  the  difficulties 
in  maintaining  robust  internal  control  environments  thus 
far  experienced  throughout  DoD  and  other  federal  agencies 
indicate  that  existing  internal  controls  for  the  GCPC 
program  have  not  been  completely  effective. 

Breakdowns  in  internal  controls  are  both 
extraordinarily  easy  to  envision  and  exceedingly  difficult 
to  prevent.  For  example,  if  an  AO,  pressed  for  time,  does 
not  actually  review  all  the  transactions  for  a  particular 
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cardholder  and  instead  simply  certifies  the  invoice  to 
ensure  it  is  submitted  on  time,  there  exists  a  potential 
for  fraud  to  escape  detection.  If  a  unit,  due  to  personnel 
limitations  for  instance,  does  not  really  separate  the 
duties  of  purchasing,  receipting  for,  and  inventorying 
purchased  items,  the  GCPC  cardholder  making  the  purchase 
has  ample  opportunity  to  defraud  the  government.  No  matter 
how  well  the  administrators  designed  the  controls,  no 
system  or  process  can  reasonably  be  made  fraud-proof. 

In  recent  years,  much  has  been  done  to  improve  the 
ability  of  GCPC  program  administrators  to  limit  the 
opportunity  for  fraud  and  GCPC  program  card  misuse  and 
abuse,  and  to  detect  such  fraud  or  abuse  when  it  occurs. 

In  addition  to  these  past  initiatives,  other  preventive 
measures  can  be  undertaken  to  positively  influence  the 
mindsets  of  those  involved  in  the  Government-wide 
Commercial  Purchase  Card  program.  Limiting  the  ability  of 
individuals  to  rationalize  wrongful  use  of  GCPC  program 
cards  can  help  to  improve  the  program' s  internal  control 
environment  and  further  reduce  instances  of  illicit 
purchases  with  GCPC  program  cards.  By  implementing  the 
recommendations  contained  within  this  report,  the  authors 
believe  the  Marine  Corps,  DoN,  and  DoD  can  enhance 
administration  of  the  GCPC  program. 
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APPENDIX  A.  PURCHASE  CARD  RESPONSE  FORMAT 


SEMI-ANNUAL  REVIEW 
OCTOBER  1,  2002  -  MARCH  30,  2003 
Date:  4  June  2003 

Command:  Headquarters,  Marine  Corps 

POC:  Capt  Chester  McMillon 

Phone:  (703)  695-6590  ext.  2543 

Hierarchy  #: 00027 

USMC  Level  III  results  include  all  hierarchies.  The 
training  numbers  reflect  the  Level  IV  hierarchy  00055, 
Marine  Corps  Community  Services  (USMC  NAF)  GCPC  personnel 
that  have  not  met  current  DoD  and  DoN  training 
requirements . 

A.  Total  number  of  Agency  Program  Coordinators  (APCs) :  160 

B.  Total  number  of  Approving  Officials  (AOs) :  1,676 

C.  Total  number  of  purchase  card  accounts:  3,955 

D.  Number  of  APCs  that  exceeds  the  ratio  of  300  card 
accounts  to  one  APC:  0 

E.  Average  Claimancy  ratio  of  purchase  card  accounts  to 
AOs:  2.36  cardholders  per  AO. 

F.  Number  of  AO  accounts  above  the  ratio  of  7  card  accounts 
to  one  AO.  0 

G.  Number  of  Cardholders,  AOs,  APCs  with  documented 
evidence  of  successful  completion  of  mandatory  training. 
(All  USMC  APCs,  AOs,  and  cardholders,  with  the  exception  of 
the  MCCS  (USMC  NAF)  00055  hierarchy,  have  been  suspended 
until  documentation  is  provided.) 

Cardholders:  2,806 
AOS:  1,310 
APCs:  120 

H.  Questionable  transactions: 
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1  .  Number  of  purchases  not  required  to  fulfill  minimum, 
immediate  need  to  support  DoN  mission:  33 
2.  Number  of  purchases  not  for  government  use,  but  for 
personal  use:  25 

Level  IV  APC:  Marine  Corps  Community  Services  (00055) 

Item  Purchased:  Weight  belt 
Dollar  Value  of  Transaction:  $13.99 
How  it  was  discovered:  AO  review 

Disciplinary  actions  taken:  Activity  reimbursed  and 
cardholder  suspended. 

Level  IV  APC:  Marine  Corps  Community  Services  (00055) 

Item  Purchased:  Phone  charge 
Dollar  Value  of  Transaction:  $1.10 
How  it  was  discovered:  AO  Review 

Disciplinary  actions  taken:  Activity  reimbursed  and 
cardholder  suspended. 

Level  IV  APC:  Marine  Corps  Community  Services  (00055) 

Item  Purchased:  Phone  charge 
Dollar  Value  of  Transaction:  $2.25 
How  it  was  discovered:  AO  Review 

Disciplinary  actions  taken:  Activity  reimbursed  and 
cardholder  suspended. 

Level  IV  APC:  Marine  Corps  Community  Services  (00055) 

Item  Purchased:  Extra  room  charge 
Dollar  Value  of  Transaction:  $5.00 
How  it  was  discovered:  AO  Review 

Disciplinary  actions  taken:  Activity  reimbursed  and 
cardholder  suspended. 

Level  IV  APC:  Marine  Corps  Community  Services  (00055) 

Item  Purchased:  Extra  room  charge 
Dollar  Value  of  Transaction:  $5.00 
How  it  was  discovered:  AO  Review 

Disciplinary  actions  taken:  Activity  reimbursed  and 
cardholder  suspended. 

Level  IV  APC:  Marine  Corps  Community  Services  (00055) 

Item  Purchased:  Ribbon/ flowers  display 
Dollar  Value  of  Transaction:  $90.10 
How  it  was  discovered:  Security 

Disciplinary  actions  taken:  Cardholder  terminated. 
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Level  IV  APC:  Marine  Corps  Community  Services  (00055) 
Item  Purchased:  Subway  sandwich 
Dollar  Value  of  Transaction:  $5.29 
How  it  was  discovered:  AO  review 

Disciplinary  actions  taken:  Activity  reimbursed  and 
cardholder  counseled. 


Level  IV  APC:  Marine  Corps  Community  Services  (00055) 
Item  Purchased:  Theater  tickets 
Dollar  Value  of  Transaction:  $80.00 
How  it  was  discovered:  Cardholder 

Disciplinary  actions  taken:  Activity  reimbursed  and 
cardholder  verbally  reprimanded.  The  Level  III  APC  has 
instructed  the  Level  IV  APC  to  provide  written 
documentation  of  the  violation,  guidance  on  proper 
procedures,  consequences  of  future  violations  to  the 
discrepant  party. 


Level  IV  APC:  Marine  Corps  Community  Services  (00055) 

Item  Purchased:  Golf  green  fees 
Dollar  Value  of  Transaction:  35.00 
How  it  was  discovered:  Cardholder 

Disciplinary  actions  taken:  Activity  reimbursed  and 
cardholder  verbally  reprimanded.  The  Level  III  APC  has 
instructed  the  Level  IV  APC  to  provide  written 
documentation  of  the  violation,  guidance  on  proper 
procedures,  consequences  of  future  violations  to  the 
discrepant  party. 

Level  IV  APC:  Marine  Corps  Community  Services  (00055) 

Item  Purchased:  Magazines 

Dollar  Value  of  Transaction:  $20.66 

How  it  was  discovered:  Cardholder 

Disciplinary  actions  taken:  Activity  reimbursed  and 
cardholder  suspended. 

Level  IV  APC:  Marine  Corps  Base,  Camp  Lejeune  (00073) 

Item  Purchased:  Bedding,  towels,  kitchen  items  at  Target 
for  Peruvian  Officer 

Dollar  Value  of  Transaction:  $488.70 
How  it  was  discovered:  Cardholder 

Disciplinary  actions  taken:  Cardholder,  AO,  and  AO's 
supervisor  received  letters  of  caution.  Level  III  APC  has 
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recommended  that  cardholder  account  be  suspended  for  30 
days  . 

Level  IV  APC:  Marine  Corps  Base,  Camp  Lejeune  (00073) 

Item  Purchased:  $38.54 

Dollar  Value  of  Transaction:  Towels  and  other  household 
items  at  Walmart  for  Peruvian  Officer. 

How  it  was  discovered:  Cardholder 

Disciplinary  actions  taken:  Cardholder,  AO,  and  AO's 
supervisor  received  letters  of  caution.  Level  III  APC  has 
recommended  that  cardholder  account  be  suspended  for  30 
days  . 

Level  IV  APC:  Marine  Forces,  Reserve  (00077) 

Item  Purchased:  Fed  Ex  charges 
Dollar  Value  of  Transaction:  $4.41 
How  it  was  discovered:  AO 

Disciplinary  actions  taken:  Cardholder  formally  counseled. 
Level  IV  APC:  Marine  Forces,  Reserve  (00077) 

Item  Purchased:  Fuel  at  Chevron 
Dollar  Value  of  Transaction:  $73.00 
How  it  was  discovered:  Cardholder 

Disciplinary  actions  taken:  Cardholder  account  closed  and 
corporate  account  suspended. 

Level  IV  APC:  Marine  Forces,  Reserve  (00077) 

Item  Purchased:  Fuel  at  Chevron 
Dollar  Value  of  Transaction:  $54.02 
How  it  was  discovered:  Cardholder 

Disciplinary  actions  taken:  Cardholder  account  closed  and 
corporate  account  suspended 

Level  IV  APC:  Marine  Corps  Air  Ground  Combat  Center  (00087) 
Item  Purchased:  Exam  Packet  for  State  Certification 
Dollar  Value  of  Transaction:  $477.00 

How  it  was  discovered:  APC  monthly  transaction  review 
Disciplinary  actions  taken:  Letter  of  caution  to 
cardholder,  investigation  pending. 

Level  IV  APC:  Marine  Corps  Air  Ground  Combat  Center  (00087) 
Item  Purchased:  Professional  Association  Membership 
Dollar  Value  of  Transaction:  $99.00 
How  it  was  discovered:  APC  monthly  review 
Disciplinary  actions  taken:  Letter  of  caution  to 
cardholder,  investigation  pending. 
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Level  IV  APC:  Marine  Corps  Air  Ground  Combat  Center  (00087) 

Item  Purchased:  Franklin  Covey  Planner  inserts 

Dollar  Value  of  Transaction:  $54.80 

How  it  was  discovered:  APC  monthly  review 

Disciplinary  actions  taken:  Latter  of  caution  and 

investigating  reimbursement 

Level  IV  APC:  Marine  Corps  Air  Ground  Combat  Center  (00087) 

Item  Purchased:  Gaylord  Opryland  Shuttle 

Dollar  Value  of  Transaction:  $11.00 

How  it  was  discovered:  APC  monthly  review 

Disciplinary  actions  taken:  Cardholder  received  60-day 

suspension  and  must  attend  refresher  training.  The  U.S. 

treasury  was  reimbursed  for  the  total  amount. 

Level  IV  APC:  Marine  Corps  Air  Ground  Combat  Center  (00087) 

Item  Purchased:  Gaylord  Opryland 

Dollar  Value  of  Transaction:  $20.00 

How  it  was  discovered:  APC  monthly  review 

Disciplinary  actions  taken:  Cardholder  received  60-day 

suspension  and  must  attend  refresher  training.  The  U.S. 

treasury  was  reimbursed  for  the  total  amount. 

Level  IV  APC:  Marine  Corps  Air  Ground  Combat  Center  (00087) 

Item  Purchased:  Lodging,  Radisson  Opryland 

Dollar  Value  of  Transaction:  197.03 

How  it  was  discovered:  APC  monthly  review 

Disciplinary  actions  taken:  Cardholder  received  60-day 

suspension  and  must  attend  refresher  training.  The  U.S. 

treasury  was  reimbursed  for  the  total  amount. 

Level  IV  APC:  Marine  Corps  Air  Ground  Combat  Center 
(00087) 

Item  Purchased:  Lodging,  Gaylord  Opryland 
Dollar  Value  of  Transaction:  609.52 
How  it  was  discovered:  APC  monthly  review 
Disciplinary  actions  taken:  Cardholder  received  60-day 
suspension  and  must  attend  refresher  training.  The  U.S. 
treasury  was  reimbursed  for  the  total  amount. 

Level  IV  APC:  Marine  Corps  Base  Camp  Butler  (00088) 

Item  Purchased:  Soda 

Dollar  Value  of  Transaction:  $5.97 

How  it  was  discovered:  Cardholder 

Disciplinary  actions  taken:  Reimbursement  and  unit  received 
additional  training 
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Level  IV  APC:  Marine  Corps  Base  Camp  Butler  (00088) 

Item  Purchased:  Food 

Dollar  Value  of  Transaction:  $40.61 

How  it  was  discovered:  Cardholder 

Disciplinary  actions  taken:  Reimbursement  and  AO  cancelled 
cardholder  account. 

Level  IV  APC:  Marine  Corps  Base  Camp  Butler  (00088) 

Item  Purchased:  Lodging 

Dollar  Value  of  Transaction:  $939.75 

How  it  was  discovered:  Cardholder 

Disciplinary  actions  taken:  Reimbursement  and  AO  cancelled 
cardholder  account. 


3 


Number  of  purchase  that  exceeded  authorized  limits: 
10 


4  .  Number  of  requirements  that  were  split  to  circumvent 
the  micro  purchase  threshold:  259 

5 .  Number  of  purchases  that  were  prohibited  items  as 
identified  in  the  purchase  card  instruction/desk 
guides:  158 


I.  Weaknesses  in  Internal  Management  Controls: 

Level  IV  APC:  Marine  Corps  Base  Camp  Lejeune  (00073) 
Weakness  Area:  Documented  screening  of  mandatory  sources 
Corrective  Action:  All  AOs  received  training  letters. 
Discrepant  accounts  will  be  re-audited  in  3  months  and 
future  infractions  will  result  in  30-day  suspension. 

Level  IV  APC:  Marine  Corps  Recruit  Depot,  Parris  Island 
(00075) 

Weakness  Area:  Documentation  of  certification  in  proper 
time  frame. 

Corrective  Action:  Proper  certification  timeline  provided 
to  all  GCPC  personnel.  All  AOs  have  also  received 
additional  training  on  how  to  properly  document 
certification . 

Level  IV  APC:  Marine  Forces,  Reserve  (00077) 

Weakness  Area:  Maintenance  of  delegation  letter 
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Corrective  Action:  APC  will  send  e-mail  to  all  activity 
GCPC  personnel  reiterating  requirement. 

Level  IV  APC:  Marine  Forces,  Reserve  (00077) 

Weakness  Area:  Maintenance  of  documented  training 
Corrective  Action:  APC  will  send  e-mail  to  all  activity 
GCPC  personnel  reiterating  requirement. 

Level  IV  APC:  Marine  Forces,  Reserve  (00077) 

Weakness  Area:  Documented  screening  of  mandatory  sources 
Corrective  Action:  An  activity-wide  purchase  card/call  log 
is  being  developed  and  will  be  provided  to  all  GCPC 
personnel . 

Level  IV  APC:  Marine  Forces,  Reserve  (00077) 

Weakness  Area:  Documentation  of  certification  within  proper 
timeframe . 

Corrective  Action:  Guidance  will  be  sent  to  all  AOs  and 
cardholders  outlining  procedures  for  proper  documentation 
of  certification.  General  instructions  for  AOs  on  proper 
reconciliation,  reallocation,  and  certification  will  be 
included. 

Level  IV  APC:  Marine  Forces,  Reserve  (00077) 

Weakness  Area:  Proper  request  process 
Corrective  Action:  A  standard  GCPC  Purchase/Payment 
Request  will  be  provided  to  all  AOs  and  cardholders.  It 
will  also  be  included  in  the  role-based  turnover  files 
being  developed  by  the  activity. 

Level  IV  APC:  Marine  Forces,  Reserve  (00077) 

Weakness  Area:  Documented  receipt  by  end  user 
Corrective  Action:  The  purchase  request  form  will  include 
the  section  to  allow  for  the  documented  receipt.  The  new 
lOP  will  also  reiterate  the  requirement. 

Level  IV  APC:  Marine  Air  Ground  Combat  Center  (00087) 
Weakness  Area:  Proper  request  process 

Corrective  Action:  All  personnel  receiving  additional 
training  in  this  area.  Discrepant  personnel  also  received 
letters  of  caution. 

Level  IV  APC:  Marine  Corps  Base,  Quantico  (00096) 

Weakness  Area:  Documentation  of  certification  in  proper 
time  frame 
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Corrective  Action:  Discrepant  personnel  have  received 
training  and  notice  that  additional  discrepancies  will 
result  in  suspension  action. 

Level  IV  APC:  Marine  Corps  Base,  Quantico  (00096) 
Weakness  Area:  Documented  receipt  by  end  user 
Corrective  Action:  All  activity  GCPC  personnel  have 
received  reiteration  of  this  requirement  through  e-mail. 
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APPENDIX  B.  PURCHASE  CARD  ALERT  NUMBER  6 


(16  APRIL  2003) 

THIS  ALERT  IS  APPLICABLE  TO: 

APPROVING  OFFICIALS 
CARDHOLDERS 

SUBJECT:  Blocking  of  Merchant  Category  Codes 


The  purpose  of  this  Purchase  Card  Alert  is  to  remind 
Approving  Officials  and  Cardholders  of  the  Department  of 
Defense  (DoD)  policy  restricting  purchases  of 
items/services  from  merchants  coded  in  certain  categories. 
This  policy  does  not  restrict  "what"  is  purchased,  but 
rather  restricts  purchases  from  certain  types  of  merchants. 
The  below  listed  codes  are  blocked  DoD  wide  and  purchases 

are  prohibited  from  merchants  registered  under  these 

category  codes . 


4829--Wire  Transfer-Money  Orders 

5932- -Antique  Shops 

5933- -Pawn  Shops 
5937--Antique  Reproductions 
5044--Jewelry  Stores 
5960--Direct  Marketing  Insurance 

6010- -Financial  Institutions  Manual 

Cash  Advance 

60 1 1- -Financial  Institutions 

Automatic  Cash  Advance 
6051--Non-Financial  Inst it ut ion s- 
Foreign  Currency,  Money 
Orders,  Travelers  Checks 


621 1— Secur it yBrokers /Dealers 
67 60--Savings  Bonds 
7  0 12--Timeshares 
7273--Dating  &  Escort  Services 
7995--Betting,  Casino  Gaming  Chips 
Off-  Track  Betting 
8651--Political  Organizations 
9211--Court  Costs,  Alimony,  Child 
Support 

9222—  Fines 

9223- -Bail  and  Bond  Payments 
9311--Tax  Payments 
9700--Automated  Referral  Service 


In  addition  to  the  above-listed  codes ,  your  Agency  Program 
Coordinators  have  carefully  reviewed  the  mission-specific 
purchase  card  usage  of  each  activity  under  the  Purchase 
Card  Program.  The  authority  of  the  cardholders  has  been 
tailored  by  blocking  non-mission  specific  merchant  category 
codes  in  the  US  Bank  System.  Eor  example,  car  washes  are 
prohibited  purchases  within  the  WHS/RE&E  Purchase  card 
program,  therefore,  all  car  wash  vendors  will  be  blocked 
from  all  card  holders.  The  cardholders  will  not  be  able  to 
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purchase  from  "blocked"  merchants.  This  process  will 
ensure  that  purchases  are  made  only  from  authorized  types 
of  merchants. 

If  you  experience  a  decline  on  your  card,  have  the  merchant 
check  with  their  bank  to  make  sure  their  category  code  has 
been  input  correctly.  If  everything  is  correct  between  the 
merchant  and  his  bank,  then  call  your  APC  and  request  a 
one-time  approval  of  the  instant  purchase  or  approval  to 
make  purchases  from  this  merchant  category  in  the  future. 
When  contacting  the  APC  for  this  approval,  be  prepared  to 
justify  the  mission  need  for  the  purchase. 
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